On Tue, Aug 20, 2024 at 5:09 PM Julian Sun <sunjunchao2870@xxxxxxxxx> wrote: > When gfs2_fill_super() fails, destroy_workqueue() > is called within gfs2_gl_hash_clear(), and the > subsequent code path calls destroy_workqueue() > on the same work queue again. > > This issue can be fixed by setting the work > queue pointer to NULL after the first > destroy_workqueue() call and checking for > a NULL pointer before attempting to destroy > the work queue again. Applied now. Thanks, Andreas > Reported-by: syzbot+d34c2a269ed512c531b0@xxxxxxxxxxxxxxxxxxxxxxxxx > Closes: https://syzkaller.appspot.com/bug?extid=d34c2a269ed512c531b0 > Fixes: 30e388d57367 ("gfs2: Switch to a per-filesystem glock workqueue") > Cc: stable@xxxxxxxxxxxxxxx > Signed-off-by: Julian Sun <sunjunchao2870@xxxxxxxxx> > --- > fs/gfs2/glock.c | 1 + > fs/gfs2/ops_fstype.c | 3 ++- > 2 files changed, 3 insertions(+), 1 deletion(-) > > diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c > index 32991cb22023..5838039d78e3 100644 > --- a/fs/gfs2/glock.c > +++ b/fs/gfs2/glock.c > @@ -2273,6 +2273,7 @@ void gfs2_gl_hash_clear(struct gfs2_sbd *sdp) > gfs2_free_dead_glocks(sdp); > glock_hash_walk(dump_glock_func, sdp); > destroy_workqueue(sdp->sd_glock_wq); > + sdp->sd_glock_wq = NULL; > } > > static const char *state2str(unsigned state) > diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c > index 0561edd6cc86..5c0e1b24d6ec 100644 > --- a/fs/gfs2/ops_fstype.c > +++ b/fs/gfs2/ops_fstype.c > @@ -1308,7 +1308,8 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc) > fail_delete_wq: > destroy_workqueue(sdp->sd_delete_wq); > fail_glock_wq: > - destroy_workqueue(sdp->sd_glock_wq); > + if (sdp->sd_glock_wq) > + destroy_workqueue(sdp->sd_glock_wq); > fail_free: > free_sbd(sdp); > sb->s_fs_info = NULL; > -- > 2.39.2 >
