summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2021-03-15 19:59:06 +0300
committerTheodore Ts'o <tytso@mit.edu>2021-03-21 07:27:49 +0300
commit2a4ae3bcdf05b8639406eaa09a2939f3c6dd8e75 (patch)
tree91b8caa387423ca6b69fa991141da04dd739eb58
parent7d8bd3c76da1d94b85e6c9b7007e20e980bfcfe6 (diff)
downloadlinux-2a4ae3bcdf05b8639406eaa09a2939f3c6dd8e75.tar.xz
ext4: fix timer use-after-free on failed mount
When filesystem mount fails because of corrupted filesystem we first cancel the s_err_report timer reminding fs errors every day and only then we flush s_error_work. However s_error_work may report another fs error and re-arm timer thus resulting in timer use-after-free. Fix the problem by first flushing the work and only after that canceling the s_err_report timer. Reported-by: syzbot+628472a2aac693ab0fcd@syzkaller.appspotmail.com Fixes: 2d01ddc86606 ("ext4: save error info to sb through journal if available") CC: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20210315165906.2175-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso@mit.edu>
-rw-r--r--fs/ext4/super.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index a0a256859662..b9693680463a 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5154,8 +5154,8 @@ failed_mount_wq:
failed_mount3a:
ext4_es_unregister_shrinker(sbi);
failed_mount3:
- del_timer_sync(&sbi->s_err_report);
flush_work(&sbi->s_error_work);
+ del_timer_sync(&sbi->s_err_report);
if (sbi->s_mmp_tsk)
kthread_stop(sbi->s_mmp_tsk);
failed_mount2: