linux-kernel - [PATCH] ocfs2: cancel dqi_sync

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240904020949.1685198-1-joseph.qi@linux.alibaba.com>
Date: Wed,  4 Sep 2024 10:09:49 +0800
From: Joseph Qi <joseph.qi@...ux.alibaba.com>
To: Andrew Morton <akpm@...ux-foundation.org>,
	Heming Zhao <heming.zhao@...e.com>
Cc: ocfs2-devel@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	syzbot+f7af59df5d6b25f0febd@...kaller.appspotmail.com
Subject: [PATCH] ocfs2: cancel dqi_sync_work before freeing oinfo

ocfs2_global_read_info() will schedule dqi_sync_work. So any error
occurs after it, we have to cancel this delayed work first before
freeing oinfo, otherwise it will trigger the following warning with
CONFIG_DEBUG_OBJECTS_* enabled:

ODEBUG: free active (active state 0) object: 00000000d8b0ce28 object type: timer_list hint: qsync_work_fn+0x0/0x16c

Link: https://syzkaller.appspot.com/bug?extid=f7af59df5d6b25f0febd
Reported-by: syzbot+f7af59df5d6b25f0febd@...kaller.appspotmail.com
Tested-by: syzbot+f7af59df5d6b25f0febd@...kaller.appspotmail.com
Fixes: 171bf93ce11f ("ocfs2: Periodic quota syncing")
Cc: stable@...r.kernel.org
Signed-off-by: Joseph Qi <joseph.qi@...ux.alibaba.com>
---
 fs/ocfs2/quota_local.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index 8ce462c64c51..ebe0dbc8db4a 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -782,6 +782,7 @@ static int ocfs2_local_read_info(struct super_block *sb, int type)
 		if (locked)
 			ocfs2_inode_unlock(lqinode, 1);
 		ocfs2_release_local_quota_bitmaps(&oinfo->dqi_chunk);
+		cancel_delayed_work_sync(&oinfo->dqi_sync_work);
 		kfree(oinfo);
 	}
 	brelse(bh);
-- 
2.39.3