In the read error path of squashfs_symlink_readpage() the entry is put back before its error value is read: uashfs_cache_put(entry); = entry->error; Once the reference count drops to zero another thread can take the entry back from the cache for a different block and overwrite entry->error, so the value read here may be stale. Read the error before dropping the reference. Fixes: 675f02e5e656 ("squashfs: convert squashfs_symlink_read_folio to use folio APIs") Cc: stable@vger.kernel.org Signed-off-by: Guo Zihao --- QEMU boot with the patched kernel: normal, relative and absolute symlink testcases on a crafted image all resolve the same as before; the error path itself needs a concurrent reuse of the cache entry to observe. fs/squashfs/symlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/squashfs/symlink.c b/fs/squashfs/symlink.c index 6ef735bd8..9d729af20 100644 --- a/fs/squashfs/symlink.c +++ b/fs/squashfs/symlink.c @@ -74,8 +74,8 @@ static int squashfs_symlink_read_folio(struct file *file, struct folio *folio) ERROR("Unable to read symlink [%llx:%x]\n", squashfs_i(inode)->start, squashfs_i(inode)->offset); - squashfs_cache_put(entry); error = entry->error; + squashfs_cache_put(entry); goto out; } -- 2.50.1