This is a note to let you know that I've just added the patch titled ext4: fix timer use-after-free on failed mount to the 5.11-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ext4-fix-timer-use-after-free-on-failed-mount.patch and it can be found in the queue-5.11 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 2a4ae3bcdf05b8639406eaa09a2939f3c6dd8e75 Mon Sep 17 00:00:00 2001 From: Jan Kara <jack@xxxxxxx> Date: Mon, 15 Mar 2021 17:59:06 +0100 Subject: ext4: fix timer use-after-free on failed mount From: Jan Kara <jack@xxxxxxx> commit 2a4ae3bcdf05b8639406eaa09a2939f3c6dd8e75 upstream. When filesystem mount fails because of corrupted filesystem we first cancel the s_err_report timer reminding fs errors every day and only then we flush s_error_work. However s_error_work may report another fs error and re-arm timer thus resulting in timer use-after-free. Fix the problem by first flushing the work and only after that canceling the s_err_report timer. Reported-by: syzbot+628472a2aac693ab0fcd@xxxxxxxxxxxxxxxxxxxxxxxxx Fixes: 2d01ddc86606 ("ext4: save error info to sb through journal if available") CC: stable@xxxxxxxxxxxxxxx Signed-off-by: Jan Kara <jack@xxxxxxx> Link: https://lore.kernel.org/r/20210315165906.2175-1-jack@xxxxxxx Signed-off-by: Theodore Ts'o <tytso@xxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5149,8 +5149,8 @@ failed_mount_wq: failed_mount3a: ext4_es_unregister_shrinker(sbi); failed_mount3: - del_timer_sync(&sbi->s_err_report); flush_work(&sbi->s_error_work); + del_timer_sync(&sbi->s_err_report); if (sbi->s_mmp_tsk) kthread_stop(sbi->s_mmp_tsk); failed_mount2: Patches currently in stable-queue which might be from jack@xxxxxxx are queue-5.11/ext4-fix-timer-use-after-free-on-failed-mount.patch queue-5.11/ext4-fix-potential-error-in-ext4_do_update_inode.patch