__ext4_fill_super() arms s_err_report when the on-disk error count is nonzero. If a later mount step fails, the failed-mount cleanup path uses timer_delete_sync() before freeing sbi. print_daily_error_info() rearms the timer when s_err_report_sec is nonzero, so timer_delete_sync() does not prevent the timer from being queued again. The rearmed callback can then access sbi after the failed mount has freed it. Use timer_shutdown_sync() for failed-mount cleanup. This matches the normal unmount path and prevents the timer from being rearmed before sbi is freed. Fixes: 66e61a9e9504 ("ext4: Once a day, printk file system error information to dmesg") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Runyu Xiao --- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index bca0dc87d..154e00901 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5809,7 +5809,7 @@ failed_mount8: __maybe_unused /* flush s_sb_upd_work before sbi destroy */ flush_work(&sbi->s_sb_upd_work); ext4_stop_mmpd(sbi); - timer_delete_sync(&sbi->s_err_report); + timer_shutdown_sync(&sbi->s_err_report); ext4_group_desc_free(sbi); failed_mount: #if IS_ENABLED(CONFIG_UNICODE) -- 2.34.1