Commit 5e47868f authored Mar 18, 2020 by Ritesh Harjani Committed by Theodore Ts'o Mar 26, 2020

ext4: unregister sysfs path before destroying jbd2 journal



Call ext4_unregister_sysfs(), before destroying jbd2 journal,
since below might cause, NULL pointer dereference issue.
This got reported with LTP tests.

ext4_put_super() 		cat /sys/fs/ext4/loop2/journal_task
	| 				ext4_attr_show();
ext4_jbd2_journal_destroy();  			|
    	|				 journal_task_show()
	| 					|
	| 				task_pid_vnr(NULL);
sbi->s_journal = NULL;

Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20200318061301.4320-1-riteshh@linux.ibm.com


Signed-off-by: Theodore Ts'o <tytso@mit.edu>

parent f1eec3b0

fs/ext4/super.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -1024,6 +1024,13 @@ static void ext4_put_super(struct super_block *sb)

		destroy_workqueue(sbi->rsv_conversion_wq);

		/*
		* Unregister sysfs before destroying jbd2 journal.
		* Since we could still access attr_journal_task attribute via sysfs
		* path which could have sbi->s_journal->j_task as NULL
		*/
		ext4_unregister_sysfs(sb);

		if (sbi->s_journal) {
		aborted = is_journal_aborted(sbi->s_journal);
		err = jbd2_journal_destroy(sbi->s_journal);
		@@ -1034,7 +1041,6 @@ static void ext4_put_super(struct super_block *sb)
		}
		}

		ext4_unregister_sysfs(sb);
		ext4_es_unregister_shrinker(sbi);
		del_timer_sync(&sbi->s_err_report);
		ext4_release_system_zone(sb);

Admin message