| Message ID | 20210315165906.2175-1-jack@suse.cz |
|---|---|
| State | New |
| Headers | show |
| Series | ext4: Fix timer use-after-free on failed mount | expand |
On Mon, Mar 15, 2021 at 05:59:06PM +0100, Jan Kara wrote: > When filesystem mount fails because of corrupted filesystem we first > cancel the s_err_report timer reminding fs errors every day and only > then we flush s_error_work. However s_error_work may report another fs > error and re-arm timer thus resulting in timer use-after-free. Fix the > problem by first flushing the work and only after that canceling the > s_err_report timer. > > Reported-by: syzbot+628472a2aac693ab0fcd@syzkaller.appspotmail.com > Fixes: 2d01ddc86606 ("ext4: save error info to sb through journal if available") > CC: stable@vger.kernel.org > Signed-off-by: Jan Kara <jack@suse.cz> Thanks, applied. - Ted
diff --git a/fs/ext4/super.c b/fs/ext4/super.c index ad34a37278cd..2e3d4c5c2eb4 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5149,8 +5149,8 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) failed_mount3a: ext4_es_unregister_shrinker(sbi); failed_mount3: - del_timer_sync(&sbi->s_err_report); flush_work(&sbi->s_error_work); + del_timer_sync(&sbi->s_err_report); if (sbi->s_mmp_tsk) kthread_stop(sbi->s_mmp_tsk); failed_mount2:
When filesystem mount fails because of corrupted filesystem we first cancel the s_err_report timer reminding fs errors every day and only then we flush s_error_work. However s_error_work may report another fs error and re-arm timer thus resulting in timer use-after-free. Fix the problem by first flushing the work and only after that canceling the s_err_report timer. Reported-by: syzbot+628472a2aac693ab0fcd@syzkaller.appspotmail.com Fixes: 2d01ddc86606 ("ext4: save error info to sb through journal if available") CC: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz> --- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)