2021-03-15 17:01:46

by Jan Kara

Subject: [PATCH] ext4: Fix timer use-after-free on failed mount

When filesystem mount fails because of corrupted filesystem we first
cancel the s_err_report timer reminding fs errors every day and only
then we flush s_error_work. However s_error_work may report another fs
error and re-arm timer thus resulting in timer use-after-free. Fix the
problem by first flushing the work and only after that canceling the
s_err_report timer.

Reported-by: [email protected]
Fixes: 2d01ddc86606 ("ext4: save error info to sb through journal if available")
CC: [email protected]
Signed-off-by: Jan Kara <[email protected]>
---
fs/ext4/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index ad34a37278cd..2e3d4c5c2eb4 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5149,8 +5149,8 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
failed_mount3a:
ext4_es_unregister_shrinker(sbi);
failed_mount3:
- del_timer_sync(&sbi->s_err_report);
flush_work(&sbi->s_error_work);
+ del_timer_sync(&sbi->s_err_report);
if (sbi->s_mmp_tsk)
kthread_stop(sbi->s_mmp_tsk);
failed_mount2:
--
2.26.2

2021-03-21 04:30:24

by Theodore Ts'o

Subject: Re: [PATCH] ext4: Fix timer use-after-free on failed mount

On Mon, Mar 15, 2021 at 05:59:06PM +0100, Jan Kara wrote:
> When filesystem mount fails because of corrupted filesystem we first
> cancel the s_err_report timer reminding fs errors every day and only
> then we flush s_error_work. However s_error_work may report another fs
> error and re-arm timer thus resulting in timer use-after-free. Fix the
> problem by first flushing the work and only after that canceling the
> s_err_report timer.
>
> Reported-by: [email protected]
> Fixes: 2d01ddc86606 ("ext4: save error info to sb through journal if available")
> CC: [email protected]
> Signed-off-by: Jan Kara <[email protected]>

Thanks, applied.

- Ted