[PATCH] squashfs: read symlink error before putting cache entry

[Guo Zihao]

In the read error path of squashfs_symlink_readpage() the entry is
put back before its error value is read:

uashfs_cache_put(entry);
= entry->error;

Once the reference count drops to zero another thread can take the
entry back from the cache for a different block and overwrite
entry->error, so the value read here may be stale.  Read the error
before dropping the reference.

Fixes: 675f02e5e656 ("squashfs: convert squashfs_symlink_read_folio to use folio APIs")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>
---
QEMU boot with the patched kernel: normal, relative and absolute symlink
testcases on a crafted image all resolve the same as before; the error
path itself needs a concurrent reuse of the cache entry to observe.

 fs/squashfs/symlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/squashfs/symlink.c b/fs/squashfs/symlink.c
index 6ef735bd8..9d729af20 100644
--- a/fs/squashfs/symlink.c
+++ b/fs/squashfs/symlink.c
@@ -74,8 +74,8 @@ static int squashfs_symlink_read_folio(struct file *file, struct folio *folio)
 			ERROR("Unable to read symlink [%llx:%x]\n",
 				squashfs_i(inode)->start,
 				squashfs_i(inode)->offset);
-			squashfs_cache_put(entry);
 			error = entry->error;
+			squashfs_cache_put(entry);
 			goto out;
 		}
 
-- 
2.50.1