[PATCH] ext4: shut down error report timer on failed mount

[Runyu Xiao]

__ext4_fill_super() arms s_err_report when the on-disk error count is
nonzero. If a later mount step fails, the failed-mount cleanup path uses
timer_delete_sync() before freeing sbi.

print_daily_error_info() rearms the timer when s_err_report_sec is nonzero,
so timer_delete_sync() does not prevent the timer from being queued again.
The rearmed callback can then access sbi after the failed mount has freed
it.

Use timer_shutdown_sync() for failed-mount cleanup. This matches the normal
unmount path and prevents the timer from being rearmed before sbi is freed.

Fixes: 66e61a9e9504 ("ext4: Once a day, printk file system error information to dmesg")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>
---
 fs/ext4/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index bca0dc87d..154e00901 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5809,7 +5809,7 @@ failed_mount8: __maybe_unused
 	/* flush s_sb_upd_work before sbi destroy */
 	flush_work(&sbi->s_sb_upd_work);
 	ext4_stop_mmpd(sbi);
-	timer_delete_sync(&sbi->s_err_report);
+	timer_shutdown_sync(&sbi->s_err_report);
 	ext4_group_desc_free(sbi);
 failed_mount:
 #if IS_ENABLED(CONFIG_UNICODE)
-- 
2.34.1