Skip to contentSkip to conversation

ext4: Fix timer use-after-free on failed mount

PATCH Applied Jan Kara 2 participants 2 messages Mar 15, 2021 – Mar 21, 2021

Subsystems (2)
Stable branch ext4 file system
lore
Share & tools
lore

Jan Kara

author reviewer
#0 lore raw

PATCH 1/1 ext4: Fix timer use-after-free on failed mount

When filesystem mount fails because of corrupted filesystem we first cancel the s_err_report timer reminding fs errors every day and only then we flush s_error_work. However s_error_work may report another fs error and re-arm timer thus resulting in timer use-after-free. Fix the problem by first flushing the work and only after that canceling the s_err_report timer.

Reported-by [email protected]
Fixes 2d01ddc86606 ("ext4: save error info to sb through journal if available")
CC [email protected]
Signed-off-by Jan Kara <[email protected]>
---
 fs/ext4/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/super.c +1 -1
index ad34a37278cd..2e3d4c5c2eb4 100644
@@ -5149,8 +5149,8 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
 failed_mount3a:
 	ext4_es_unregister_shrinker(sbi);
 failed_mount3:
-	del_timer_sync(&sbi->s_err_report);
 	flush_work(&sbi->s_error_work);
+	del_timer_sync(&sbi->s_err_report);
 	if (sbi->s_mmp_tsk)
 		kthread_stop(sbi->s_mmp_tsk);
 failed_mount2:
Signature · 1 line
2.26.2
maintainer Applied
#1 lore raw
Quoted 11 lines · Jan Kara

When filesystem mount fails because of corrupted filesystem we first cancel the s_err_report timer reminding fs errors every day and only then we flush s_error_work. However s_error_work may report another fs error and re-arm timer thus resulting in timer use-after-free. Fix the problem by first flushing the work and only after that canceling the s_err_report timer.

Reported-by [email protected]
Fixes 2d01ddc86606 ("ext4: save error info to sb through journal if available")
CC [email protected]
Signed-off-by Jan Kara <[email protected]>

Thanks, applied.

- Ted