moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

writeback: avoid use-after-free after removing device

Browse Source 
commit f87904c075515f3e1d8f4a7115869d3b914674fd upstream.

When a disk is removed, bdi_unregister gets called to stop further
writeback and wait for associated delayed work to complete.  However,
wb_inode_writeback_end() may schedule bandwidth estimation dwork after
this has completed, which can result in the timer attempting to access the
just freed bdi_writeback.

Fix this by checking if the bdi_writeback is alive, similar to when
scheduling writeback work.

Since this requires wb->work_lock, and wb_inode_writeback_end() may get
called from interrupt, switch wb->work_lock to an irqsafe lock.

Link: https://lkml.kernel.org/r/20220801155034.3772543-1-khazhy@google.com
Fixes: 45a2966fd6 ("writeback: fix bandwidth estimate for spiky workload")
Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Michael Stapelberg <stapelberg+linux@google.com>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Khazhismel Kumykov
2022-08-01 08:50:34 -07:00
committed by Greg Kroah-Hartman
parent 0455bef690
commit f96b9f7c16
3 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
fs/fs-writeback.c
View File

@@ -134,10 +134,10 @@ static bool inode_io_list_move_locked(struct inode *inode,
static void wb_wakeup(struct bdi_writeback *wb) static void wb_wakeup(struct bdi_writeback *wb)
{ {
spin_lock_bh(&wb->work_lock); spin_lock_irq(&wb->work_lock);
if (test_bit(WB_registered, &wb->state)) if (test_bit(WB_registered, &wb->state))
mod_delayed_work(bdi_wq, &wb->dwork, 0); mod_delayed_work(bdi_wq, &wb->dwork, 0);
spin_unlock_bh(&wb->work_lock); spin_unlock_irq(&wb->work_lock);
} }
static void finish_writeback_work(struct bdi_writeback *wb, static void finish_writeback_work(struct bdi_writeback *wb,
@@ -164,7 +164,7 @@ static void wb_queue_work(struct bdi_writeback *wb,
if (work->done) if (work->done)
atomic_inc(&work->done->cnt); atomic_inc(&work->done->cnt);
spin_lock_bh(&wb->work_lock); spin_lock_irq(&wb->work_lock);
if (test_bit(WB_registered, &wb->state)) { if (test_bit(WB_registered, &wb->state)) {
list_add_tail(&work->list, &wb->work_list); list_add_tail(&work->list, &wb->work_list);
@@ -172,7 +172,7 @@ static void wb_queue_work(struct bdi_writeback *wb,
} else } else
finish_writeback_work(wb, work); finish_writeback_work(wb, work);
spin_unlock_bh(&wb->work_lock); spin_unlock_irq(&wb->work_lock);
} }
/** /**
@@ -2109,13 +2109,13 @@ static struct wb_writeback_work *get_next_work_item(struct bdi_writeback *wb)
{ {
struct wb_writeback_work *work = NULL; struct wb_writeback_work *work = NULL;
spin_lock_bh(&wb->work_lock); spin_lock_irq(&wb->work_lock);
if (!list_empty(&wb->work_list)) { if (!list_empty(&wb->work_list)) {
work = list_entry(wb->work_list.next, work = list_entry(wb->work_list.next,
struct wb_writeback_work, list); struct wb_writeback_work, list);
list_del_init(&work->list); list_del_init(&work->list);
} }
spin_unlock_bh(&wb->work_lock); spin_unlock_irq(&wb->work_lock);
return work; return work;
} }

10
mm/backing-dev.c
View File

@@ -258,10 +258,10 @@ void wb_wakeup_delayed(struct bdi_writeback *wb)
unsigned long timeout; unsigned long timeout;
timeout = msecs_to_jiffies(dirty_writeback_interval * 10); timeout = msecs_to_jiffies(dirty_writeback_interval * 10);
spin_lock_bh(&wb->work_lock); spin_lock_irq(&wb->work_lock);
if (test_bit(WB_registered, &wb->state)) if (test_bit(WB_registered, &wb->state))
queue_delayed_work(bdi_wq, &wb->dwork, timeout); queue_delayed_work(bdi_wq, &wb->dwork, timeout);
spin_unlock_bh(&wb->work_lock); spin_unlock_irq(&wb->work_lock);
} }
static void wb_update_bandwidth_workfn(struct work_struct *work) static void wb_update_bandwidth_workfn(struct work_struct *work)
@@ -337,12 +337,12 @@ static void cgwb_remove_from_bdi_list(struct bdi_writeback *wb);
static void wb_shutdown(struct bdi_writeback *wb) static void wb_shutdown(struct bdi_writeback *wb)
{ {
/* Make sure nobody queues further work */ /* Make sure nobody queues further work */
spin_lock_bh(&wb->work_lock); spin_lock_irq(&wb->work_lock);
if (!test_and_clear_bit(WB_registered, &wb->state)) { if (!test_and_clear_bit(WB_registered, &wb->state)) {
spin_unlock_bh(&wb->work_lock); spin_unlock_irq(&wb->work_lock);
return; return;
} }
spin_unlock_bh(&wb->work_lock); spin_unlock_irq(&wb->work_lock);
cgwb_remove_from_bdi_list(wb); cgwb_remove_from_bdi_list(wb);
/* /*

6
mm/page-writeback.c
View File

@@ -2755,6 +2755,7 @@ static void wb_inode_writeback_start(struct bdi_writeback *wb)
static void wb_inode_writeback_end(struct bdi_writeback *wb) static void wb_inode_writeback_end(struct bdi_writeback *wb)
{ {
unsigned long flags;
atomic_dec(&wb->writeback_inodes); atomic_dec(&wb->writeback_inodes);
/* /*
* Make sure estimate of writeback throughput gets updated after * Make sure estimate of writeback throughput gets updated after
@@ -2763,7 +2764,10 @@ static void wb_inode_writeback_end(struct bdi_writeback *wb)
* that if multiple inodes end writeback at a similar time, they get * that if multiple inodes end writeback at a similar time, they get
* batched into one bandwidth update. * batched into one bandwidth update.
*/ */
queue_delayed_work(bdi_wq, &wb->bw_dwork, BANDWIDTH_INTERVAL); spin_lock_irqsave(&wb->work_lock, flags);
if (test_bit(WB_registered, &wb->state))
queue_delayed_work(bdi_wq, &wb->bw_dwork, BANDWIDTH_INTERVAL);
spin_unlock_irqrestore(&wb->work_lock, flags);
} }
int test_clear_page_writeback(struct page *page) int test_clear_page_writeback(struct page *page)