UPSTREAM: ext4: fail ext4_iget for root directory if unallocated

commit 8e4b5eae5decd9dfe5a4ee369c22028f90ab4c44 upstream.

If the root directory has an i_links_count of zero, then when the file
system is mounted, then when ext4_fill_super() notices the problem and
tries to call iput() the root directory in the error return path,
ext4_evict_inode() will try to free the inode on disk, before all of
the file system structures are set up, and this will result in an OOPS
caused by a NULL pointer dereference.

This issue has been assigned CVE-2018-1092.

Reported-by: Wen Xu <>
Signed-off-by: Theodore Ts'o <>
Signed-off-by: Greg Kroah-Hartman <>


Change-Id: I3da89db25e609a24ff6962032c4c8a0ef819bd08
Signed-off-by: Pradeep Sawlani <>
Reviewed-by: Guenter Roeck <>
1 file changed