Commit 2a4ae3bc authored by Jan Kara's avatar Jan Kara Committed by Theodore Ts'o
Browse files

ext4: fix timer use-after-free on failed mount 



When filesystem mount fails because of corrupted filesystem we first
cancel the s_err_report timer reminding fs errors every day and only
then we flush s_error_work. However s_error_work may report another fs
error and re-arm timer thus resulting in timer use-after-free. Fix the
problem by first flushing the work and only after that canceling the
s_err_report timer.

Reported-by: default avatar <syzbot+628472a2aac693ab0fcd@syzkaller.appspotmail.com>
Fixes: 2d01ddc8 ("ext4: save error info to sb through journal if available")
CC: stable@vger.kernel.org
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20210315165906.2175-1-jack@suse.cz


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
parent 7d8bd3c7

fs/ext4/super.c

+1 −1
Original line number Diff line number Diff line
@@ -5154,8 +5154,8 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) 
failed_mount3a:

	ext4_es_unregister_shrinker(sbi);

failed_mount3:

	del_timer_sync(&sbi->s_err_report);

	flush_work(&sbi->s_error_work);

	del_timer_sync(&sbi->s_err_report);

	if (sbi->s_mmp_tsk)

		kthread_stop(sbi->s_mmp_tsk);

failed_mount2: