bcachefs: Fix null deref in bch2_ioctl_read_super

Do not attempt to cleanup the returned value of bch2_device_lookup if
the returned value was an error pointer. We currently check to see if
the returned value is null and run the cleanup otherwise. As a result,
we attempt to run the cleanup on a error pointer.

Signed-off-by: Dan Robertson <dan@dlrobertson.com>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>

diff --git a/fs/bcachefs/chardev.c b/fs/bcachefs/chardev.c
index 34085e32a1599e5e553e72dc93f18775f40ca4c0..b0cbbb70161d04957c96678c4c4ffbe87ab99b74 100644 (file)
--- a/fs/bcachefs/chardev.c
+++ b/fs/bcachefs/chardev.c
@@ -523,7 +523,7 @@ static long bch2_ioctl_read_super(struct bch_fs *c,
        ret = copy_to_user((void __user *)(unsigned long)arg.sb,
                           sb, vstruct_bytes(sb));
 err:
-       if (ca)
+       if (!IS_ERR_OR_NULL(ca))
                percpu_ref_put(&ca->ref);
        mutex_unlock(&c->sb_lock);
        return ret;