Roman Gushchin 80af2c9ee1 writeback, cgroup: increment isw_nr_in_flight before grabbing an inode ... [ Upstream commit 8826ee4fe7 ] isw_nr_in_flight is used to determine whether the inode switch queue should be flushed from the umount path. Currently it's increased after grabbing an inode and even scheduling the switch work. It means the umount path can walk past cleanup_offline_cgwb() with active inode references, which can result in a "Busy inodes after unmount." message and use-after-free issues (with inode->i_sb which gets freed). Fix it by incrementing isw_nr_in_flight before doing anything with the inode and decrementing in the case when switching wasn't scheduled. The problem hasn't yet been seen in the real life and was discovered by Jan Kara by looking into the code. Link: https://lkml.kernel.org/r/20210608230225.2078447-4-guro@fb.com Signed-off-by: Roman Gushchin <guro@fb.com> Suggested-by: Jan Kara <jack@suse.com> Reviewed-by: Jan Kara <jack@suse.cz> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Dave Chinner <dchinner@redhat.com> Cc: Dennis Zhou <dennis@kernel.org> Cc: Tejun Heo <tj@kernel.org> Cc: Jens Axboe <axboe@kernel.dk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-07-14 16:53:19 +02:00
..
9p	9P: Cast to loff_t before multiplying	2020-11-05 11:43:34 +01:00
adfs
affs	fs/affs: release old buffer head on error path	2021-03-04 10:26:48 +01:00
afs	afs: Fix an IS_ERR() vs NULL check	2021-06-23 14:41:23 +02:00
autofs	autofs: fix a leak in autofs_expire_indirect()	2019-10-25 00:03:11 -04:00
befs
bfs	bfs: don't use WARNING: string when it's just info.	2021-01-06 14:48:39 +01:00
btrfs	btrfs: disable build on platforms having page size 256K	2021-07-14 16:53:14 +02:00
cachefiles	cachefiles: Handle readpage error correctly	2020-11-05 11:43:36 +01:00
ceph	ceph: fix fscache invalidation	2021-05-22 11:38:29 +02:00
cifs	cifs: fix missing spinlock around update to ses->status	2021-07-14 16:53:19 +02:00
coda
configfs	configfs: fix a use-after-free in __configfs_open_file	2021-03-17 17:03:56 +01:00
cramfs	cramfs: fix usage on non-MTD device	2019-11-23 21:44:49 -05:00
crypto	fscrypt: remove kernel-internal constants from UAPI header	2021-01-06 14:48:35 +01:00
debugfs	debugfs: do not attempt to create a new file before the filesystem is initalized	2021-03-04 10:26:10 +01:00
devpts
dlm	fs: dlm: fix memory leak when fenced	2021-07-14 16:53:17 +02:00
ecryptfs	Revert "ecryptfs: replace BUG_ON with error handling code"	2021-05-26 12:05:19 +02:00
efivarfs	efivarfs: revert "fix memory leak in efivarfs_create()"	2020-12-02 08:49:53 +01:00
efs
erofs	erofs: add unsupported inode i_format check	2021-05-11 14:04:02 +02:00
exportfs	exportfs_decode_fh(): negative pinned may become positive without the parent locked	2019-11-10 11:56:05 -05:00
ext2	ext2: don't update mtime on COW faults	2020-09-09 19:12:30 +02:00
ext4	ext4: use ext4_grp_locked_error in mb_find_extent	2021-07-14 16:53:03 +02:00
f2fs	f2fs: fix error handling in f2fs_end_enable_verity()	2021-05-19 10:08:32 +02:00
fat	fat: don't allow to mount if the FAT length == 0	2020-06-17 16:40:36 +02:00
freevxfs
fscache
fuse	fuse: reject internal errno	2021-07-14 16:53:09 +02:00
gfs2	gfs2: Fix use-after-free in gfs2_glock_shrink_scan	2021-06-18 09:58:59 +02:00
hfs
hfsplus	hfsplus: prevent corruption in shrinking truncate	2021-05-19 10:08:29 +02:00
hostfs	hostfs: fix memory handling in follow_link()	2021-04-14 08:24:14 +02:00
hpfs
hugetlbfs	mm/hugetlb: fix F_SEAL_FUTURE_WRITE	2021-05-19 10:08:29 +02:00
iomap	iomap: fix sub-page uptodate handling	2021-05-19 10:08:30 +02:00
isofs	isofs: release buffer head before return	2021-03-04 10:26:30 +01:00
jbd2	jbd2: fix up sparse warnings in checkpoint code	2020-11-18 19:20:30 +01:00
jffs2	jffs2: check the validity of dstlen in jffs2_zlib_compress()	2021-05-11 14:04:16 +02:00
jfs	JFS: more checks for invalid superblock	2021-03-07 12:20:41 +01:00
kernfs	kernfs: do not call fsnotify() with name without a parent	2020-08-19 08:16:12 +02:00
lockd	lockd: don't use interval-based rebinding over TCP	2020-12-30 11:51:16 +01:00
minix	fs/minix: remove expected error message in block_to_path()	2020-08-21 13:05:37 +02:00
nfs	NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error.	2021-06-16 11:59:45 +02:00
nfs_common	nfs_common: need lock during iterate through the list	2020-12-30 11:51:22 +01:00
nfsd	NFSD: fix error handling in NFSv4.0 callbacks	2021-04-07 14:47:39 +02:00
nilfs2	nilfs2: fix memory leak in nilfs_sysfs_delete_device_group	2021-06-30 08:47:50 -04:00
nls
notify	fanotify: fix ignore mask logic for events on child and on dir	2020-06-17 16:40:24 +02:00
ntfs	ntfs: fix validity check for file name attribute	2021-07-14 16:53:01 +02:00
ocfs2	ocfs2: fix data corruption by fallocate	2021-06-10 13:37:12 +02:00
omfs
openpromfs
orangefs	orangefs: get rid of knob code...	2020-08-21 13:05:29 +02:00
overlayfs	ovl: fix missing revert_creds() on error path	2021-05-14 09:44:16 +02:00
proc	proc: only require mm_struct for writing	2021-06-16 11:59:46 +02:00
pstore	pstore: Fix typo in compression option name	2021-03-04 10:26:45 +01:00
qnx4
qnx6
quota	quota: Fix memory leak when handling corrupted quota file	2021-03-04 10:26:26 +01:00
ramfs	ramfs: fix nommu mmap with gaps in the page cache	2020-10-29 09:57:53 +01:00
reiserfs	reiserfs: update reiserfs_xattrs_initialized() condition	2021-04-07 14:47:43 +02:00
romfs	romfs: fix uninitialized memory leak in romfs_dev_read()	2020-08-26 10:40:51 +02:00
squashfs	squashfs: fix divide error in calculate_skip()	2021-05-19 10:08:29 +02:00
sysfs	sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output	2021-03-07 12:20:48 +01:00
sysv
tracefs	tracing: Do not create tracefs files if tracefs lockdown is in effect	2019-10-12 20:49:07 -04:00
ubifs	ubifs: Only check replay with inode type to judge if inode linked	2021-05-11 14:04:14 +02:00
udf	udf: fix silent AED tagLocation corruption	2021-03-17 17:03:41 +01:00
ufs	fs/ufs: avoid potential u32 multiplication overflow	2020-08-21 13:05:37 +02:00
unicode
verity
xfs	xfs: Fix assert failure in xfs_setattr_size()	2021-03-07 12:20:42 +01:00
aio.c	aio: fix async fsync creds	2020-06-17 16:40:24 +02:00
anon_inodes.c
attr.c	utimes: Clamp the timestamps in notify_change()	2020-02-11 04:35:12 -08:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c	fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()	2020-06-03 08:21:27 +02:00
binfmt_elf_fdpic.c
binfmt_em86.c
binfmt_flat.c	binfmt_flat: revert "binfmt_flat: don't offset the data start"	2020-09-03 11:26:39 +02:00
binfmt_misc.c	binfmt_misc: fix possible deadlock in bm_register_write	2021-03-17 17:03:57 +01:00
binfmt_script.c
block_dev.c	block: reexpand iov_iter after read/write	2021-05-22 11:38:29 +02:00
buffer.c	fs: Don't invalidate page buffers in block_write_full_page()	2020-11-05 11:43:24 +01:00
char_dev.c	chardev: Avoid potential use-after-free in 'chrdev_open()'	2020-01-14 20:08:18 +01:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c	fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP	2020-01-09 10:20:05 +01:00
coredump.c	coredump: fix core_pattern parse error	2020-12-11 13:23:30 +01:00
d_path.c	fs: fix NULL dereference due to data race in prepend_path()	2020-10-29 09:57:45 +01:00
dax.c	mm: provide a saner PTE walking API for modules	2021-02-26 10:10:28 +01:00
dcache.c	fix dget_parent() fastpath race	2020-10-01 13:17:19 +02:00
dcookies.c
direct-io.c	fs: direct-io: fix missing sdio->boundary	2021-04-14 08:24:11 +02:00
drop_caches.c	fs: avoid softlockups in s_inodes iterators	2020-01-12 12:21:37 +01:00
eventfd.c	eventfd: track eventfd_signal() recursion depth	2020-02-11 04:35:37 -08:00
eventpoll.c	ep_create_wakeup_source(): dentry name can change under you...	2020-10-07 08:01:31 +02:00
exec.c	exec: Transform exec_update_mutex into a rw_semaphore	2021-01-09 13:44:55 +01:00
fcntl.c	fcntl: Fix potential deadlock in send_sig{io, urg}()	2021-01-06 14:48:39 +01:00
fhandle.c
file.c	fix multiplication overflow in copy_fdtable()	2020-05-27 17:46:12 +02:00
file_table.c
filesystems.c	fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()	2020-04-17 10:50:21 +02:00
fs-writeback.c	writeback, cgroup: increment isw_nr_in_flight before grabbing an inode	2021-07-14 16:53:19 +02:00
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fsopen.c
inode.c	futex: Fix inode life-time issue	2020-03-25 08:25:58 +01:00
internal.h	fs: move guard_bio_eod() after bio_set_op_attrs	2020-01-17 19:48:21 +01:00
io_uring.c	io_uring: Fix current->fs handling in io_sq_wq_submit_work()	2021-01-30 13:54:10 +01:00
ioctl.c	compat_ioctl: add compat_ptr_ioctl()	2019-12-17 19:55:30 +01:00
Kconfig
Kconfig.binfmt
libfs.c	libfs: fix error cast of negative value in simple_attr_write()	2020-11-24 13:29:19 +01:00
locks.c	locks: reinstate locks_delete_block optimization	2020-03-25 08:25:41 +01:00
Makefile
mbcache.c
mount.h
mpage.c	fs: move guard_bio_eod() after bio_set_op_attrs	2020-01-17 19:48:21 +01:00
namei.c	namei: only return -ECHILD from follow_dotdot_rcu()	2020-03-05 16:43:48 +01:00
namespace.c	fs/namespace.c: WARN if mnt_count has become negative	2021-01-06 14:48:40 +01:00
no-block.c
nsfs.c
open.c	cifs_atomic_open(): fix double-put on late allocation failure	2020-03-18 07:17:51 +01:00
pipe.c
pnode.c	propagate_one(): mnt_set_mountpoint() needs mount_lock	2020-05-02 08:48:44 +02:00
pnode.h	mount: fix mounting of detached mounts onto targets that reside on shared mounts	2021-03-17 17:03:33 +01:00
posix_acl.c
proc_namespace.c
read_write.c	fs: allow deduplication of eof block into the end of the destination file	2020-02-11 04:35:23 -08:00
readdir.c	readdir: make sure to verify directory entry for legacy interfaces too	2021-04-21 12:56:16 +02:00
select.c	kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()	2021-03-24 11:26:44 +01:00
seq_file.c
signalfd.c	fs/signalfd.c: fix inconsistent return codes for signalfd4	2020-08-26 10:40:58 +02:00
splice.c	splice: only read in as much information as there is pipe buffer space	2019-12-17 19:56:52 +01:00
stack.c
stat.c
statfs.c
super.c	vfs: remove lockdep bogosity in __sb_start_write	2020-11-24 13:29:01 +01:00
sync.c
timerfd.c
userfaultfd.c	userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK	2020-01-04 19:18:32 +01:00
utimes.c	utimes: Clamp the timestamps in notify_change()	2020-02-11 04:35:12 -08:00
xattr.c	xattr: break delegations in {set,remove}xattr	2020-08-11 15:33:39 +02:00