• Jan Kara's avatar
    reiserfs: Fix use after free in journal teardown · 01777836
    Jan Kara authored
    If do_journal_release() races with do_journal_end() which requeues
    delayed works for transaction flushing, we can leave work items for
    flushing outstanding transactions queued while freeing them. That
    results in use after free and possible crash in run_timers_softirq().
    
    Fix the problem by not requeueing works if superblock is being shut down
    (MS_ACTIVE not set) and using cancel_delayed_work_sync() in
    do_journal_release().
    
    CC: stable@vger.kernel.org
    Signed-off-by: default avatarJan Kara <jack@suse.cz>
    01777836
super.c 67.5 KB