gfs2: fix double destroy_workqueue error

commit 6cb9df81a2c462b89d2f9611009ab43ae8717841 upstream.

When gfs2_fill_super() fails, destroy_workqueue() is called within
gfs2_gl_hash_clear(), and the subsequent code path calls
destroy_workqueue() on the same work queue again.

This issue can be fixed by setting the work queue pointer to NULL after
the first destroy_workqueue() call and checking for a NULL pointer
before attempting to destroy the work queue again.

Reported-by: syzbot+d34c2a269ed512c531b0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d34c2a269ed512c531b0
Fixes: 30e388d57367 ("gfs2: Switch to a per-filesystem glock workqueue")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Sun <sunjunchao2870@gmail.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 12a769077ea0b36c72fb2361b466d179766620cd..4775c2cb8ae1b7768db11b8171ae1e2a284aa20c 100644 (file)
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -2249,6 +2249,7 @@ void gfs2_gl_hash_clear(struct gfs2_sbd *sdp)
        gfs2_free_dead_glocks(sdp);
        glock_hash_walk(dump_glock_func, sdp);
        destroy_workqueue(sdp->sd_glock_wq);
+       sdp->sd_glock_wq = NULL;
 }
 
 static const char *state2str(unsigned state)

diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index ff1f3e3dc65c9db08728fee9ef707a3b911d1302..e83d293c361423493ca94059ad64e089859746af 100644 (file)
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1307,7 +1307,8 @@ fail_debug:
 fail_delete_wq:
        destroy_workqueue(sdp->sd_delete_wq);
 fail_glock_wq:
-       destroy_workqueue(sdp->sd_glock_wq);
+       if (sdp->sd_glock_wq)
+               destroy_workqueue(sdp->sd_glock_wq);
 fail_free:
        free_sbd(sdp);
        sb->s_fs_info = NULL;