diff options
| author | Jan Kara <jack@suse.cz> | 2014-08-06 19:43:56 +0200 |
|---|---|---|
| committer | Jan Kara <jack@suse.cz> | 2014-08-12 12:46:30 +0200 |
| commit | 01777836c87081e4f68c4a43c9abe6114805f91e (patch) | |
| tree | 249981494b2563e689b091fe4e67929e4ddc113c /fs/reiserfs/super.c | |
| parent | 27d0e5bc85f3341b9ba66f0c23627cf9d7538c9d (diff) | |
| download | lwn-01777836c87081e4f68c4a43c9abe6114805f91e.tar.gz lwn-01777836c87081e4f68c4a43c9abe6114805f91e.zip | |
reiserfs: Fix use after free in journal teardown
If do_journal_release() races with do_journal_end() which requeues
delayed works for transaction flushing, we can leave work items for
flushing outstanding transactions queued while freeing them. That
results in use after free and possible crash in run_timers_softirq().
Fix the problem by not requeueing works if superblock is being shut down
(MS_ACTIVE not set) and using cancel_delayed_work_sync() in
do_journal_release().
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/reiserfs/super.c')
| -rw-r--r-- | fs/reiserfs/super.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c index a392cef6acc6..5fd8f57e07fc 100644 --- a/fs/reiserfs/super.c +++ b/fs/reiserfs/super.c @@ -100,7 +100,11 @@ void reiserfs_schedule_old_flush(struct super_block *s) struct reiserfs_sb_info *sbi = REISERFS_SB(s); unsigned long delay; - if (s->s_flags & MS_RDONLY) + /* + * Avoid scheduling flush when sb is being shut down. It can race + * with journal shutdown and free still queued delayed work. + */ + if (s->s_flags & MS_RDONLY || !(s->s_flags & MS_ACTIVE)) return; spin_lock(&sbi->old_work_lock); |