mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 21:33:52 +00:00
fs: do not update freeing inode i_io_list
[ Upstream commit4e3c51f4e8
] After commitcbfecb927f
("fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE") writeback_single_inode can push inode with I_DIRTY_TIME set to b_dirty_time list. In case of freeing inode with I_DIRTY_TIME set this can happen after deletion of inode from i_io_list at evict. Stack trace is following. evict fat_evict_inode fat_truncate_blocks fat_flush_inodes writeback_inode sync_inode_metadata(inode, sync=0) writeback_single_inode(inode, wbc) <- wbc->sync_mode == WB_SYNC_NONE This will lead to use after free in flusher thread. Similar issue can be triggered if writeback_single_inode in the stack trace update inode->i_io_list. Add explicit check to avoid it. Fixes:cbfecb927f
("fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE") Reported-by: syzbot+6ba92bd00d5093f7e371@syzkaller.appspotmail.com Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Svyatoslav Feldsherov <feldsherov@google.com> Link: https://lore.kernel.org/r/20221115202001.324188-1-feldsherov@google.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
fba0a70100
commit
fe2f36b330
1 changed files with 19 additions and 11 deletions
|
@ -1712,9 +1712,14 @@ static int writeback_single_inode(struct inode *inode,
|
||||||
wb = inode_to_wb_and_lock_list(inode);
|
wb = inode_to_wb_and_lock_list(inode);
|
||||||
spin_lock(&inode->i_lock);
|
spin_lock(&inode->i_lock);
|
||||||
/*
|
/*
|
||||||
* If the inode is now fully clean, then it can be safely removed from
|
* If the inode is freeing, its i_io_list shoudn't be updated
|
||||||
* its writeback list (if any). Otherwise the flusher threads are
|
* as it can be finally deleted at this moment.
|
||||||
* responsible for the writeback lists.
|
*/
|
||||||
|
if (!(inode->i_state & I_FREEING)) {
|
||||||
|
/*
|
||||||
|
* If the inode is now fully clean, then it can be safely
|
||||||
|
* removed from its writeback list (if any). Otherwise the
|
||||||
|
* flusher threads are responsible for the writeback lists.
|
||||||
*/
|
*/
|
||||||
if (!(inode->i_state & I_DIRTY_ALL))
|
if (!(inode->i_state & I_DIRTY_ALL))
|
||||||
inode_cgwb_move_to_attached(inode, wb);
|
inode_cgwb_move_to_attached(inode, wb);
|
||||||
|
@ -1723,7 +1728,10 @@ static int writeback_single_inode(struct inode *inode,
|
||||||
redirty_tail_locked(inode, wb);
|
redirty_tail_locked(inode, wb);
|
||||||
else if (inode->i_state & I_DIRTY_TIME) {
|
else if (inode->i_state & I_DIRTY_TIME) {
|
||||||
inode->dirtied_when = jiffies;
|
inode->dirtied_when = jiffies;
|
||||||
inode_io_list_move_locked(inode, wb, &wb->b_dirty_time);
|
inode_io_list_move_locked(inode,
|
||||||
|
wb,
|
||||||
|
&wb->b_dirty_time);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue