CVE-2024-49960

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ext4: fix timer use-after-free on failed mount<br /> <br /> Syzbot has found an ODEBUG bug in ext4_fill_super<br /> <br /> The del_timer_sync function cancels the s_err_report timer,<br /> which reminds about filesystem errors daily. We should<br /> guarantee the timer is no longer active before kfree(sbi).<br /> <br /> When filesystem mounting fails, the flow goes to failed_mount3,<br /> where an error occurs when ext4_stop_mmpd is called, causing<br /> a read I/O failure. This triggers the ext4_handle_error function<br /> that ultimately re-arms the timer,<br /> leaving the s_err_report timer active before kfree(sbi) is called.<br /> <br /> Fix the issue by canceling the s_err_report timer after calling ext4_stop_mmpd.