a533603572
commit 6cb9df81a2c462b89d2f9611009ab43ae8717841 upstream.
When gfs2_fill_super() fails, destroy_workqueue() is called within
gfs2_gl_hash_clear(), and the subsequent code path calls
destroy_workqueue() on the same work queue again.
This issue can be fixed by setting the work queue pointer to NULL after
the first destroy_workqueue() call and checking for a NULL pointer
before attempting to destroy the work queue again.
Reported-by: syzbot+d34c2a269ed512c531b0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d34c2a269ed512c531b0
Fixes:
|
||
---|---|---|
.. | ||
acl.c | ||
acl.h | ||
aops.c | ||
aops.h | ||
bmap.c | ||
bmap.h | ||
dentry.c | ||
dir.c | ||
dir.h | ||
export.c | ||
file.c | ||
gfs2.h | ||
glock.c | ||
glock.h | ||
glops.c | ||
glops.h | ||
incore.h | ||
inode.c | ||
inode.h | ||
Kconfig | ||
lock_dlm.c | ||
log.c | ||
log.h | ||
lops.c | ||
lops.h | ||
main.c | ||
Makefile | ||
meta_io.c | ||
meta_io.h | ||
ops_fstype.c | ||
quota.c | ||
quota.h | ||
recovery.c | ||
recovery.h | ||
rgrp.c | ||
rgrp.h | ||
super.c | ||
super.h | ||
sys.c | ||
sys.h | ||
trace_gfs2.h | ||
trans.c | ||
trans.h | ||
util.c | ||
util.h | ||
xattr.c | ||
xattr.h |