ext4: fix timer use-after-free on failed mount

commit 2a4ae3bcdf05b8639406eaa09a2939f3c6dd8e75 upstream.

When filesystem mount fails because of corrupted filesystem we first
cancel the s_err_report timer reminding fs errors every day and only
then we flush s_error_work. However s_error_work may report another fs
error and re-arm timer thus resulting in timer use-after-free. Fix the
problem by first flushing the work and only after that canceling the
s_err_report timer.

Reported-by: syzbot+628472a2aac693ab0fcd@syzkaller.appspotmail.com
Fixes: 2d01ddc86606 ("ext4: save error info to sb through journal if available")
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20210315165906.2175-1-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 2ae0af1c88c789f799b9bae54d9966855c7d78e4..a1353b0825ea3971d5ede3848bf982fb48a37abb 100644 (file)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5149,8 +5149,8 @@ failed_mount_wq:
 failed_mount3a:
        ext4_es_unregister_shrinker(sbi);
 failed_mount3:
-       del_timer_sync(&sbi->s_err_report);
        flush_work(&sbi->s_error_work);
+       del_timer_sync(&sbi->s_err_report);
        if (sbi->s_mmp_tsk)
                kthread_stop(sbi->s_mmp_tsk);
 failed_mount2: