Commit 889c05cc authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Jens Axboe
Browse files

block: ensure the bdi is freed after inode_detach_wb 



inode_detach_wb references the "main" bdi of the inode.  With the
recent change to move the bdi from the request_queue to the gendisk
this causes a guaranteed use after free when using certain cgroup
configurations.  The big itself is older through as any non-default
inode reference (e.g. an open file descriptor) could have injected
this use after free even before that.

Fixes: 52ebea74 ("writeback: make backing_dev_info host cgroup-specific bdi_writebacks")
Reported-by: default avatarQian Cai <quic_qiancai@quicinc.com>
Reported-by: default avatarsyzbot <syzbot+1fb38bb7d3ce0fa3e1c4@syzkaller.appspotmail.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20210816122614.601358-3-hch@lst.de


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 9451aa0a

block/genhd.c

+0 −1
Original line number Diff line number Diff line
@@ -1084,7 +1084,6 @@ static void disk_release(struct device *dev) 


	might_sleep();



	bdi_put(disk->bdi);

	disk_release_events(disk);

	kfree(disk->random);

	xa_destroy(&disk->part_tbl);

fs/block_dev.c

+4 −3
Original line number Diff line number Diff line
@@ -812,8 +812,11 @@ static void bdev_free_inode(struct inode *inode) 
	free_percpu(bdev->bd_stats);

	kfree(bdev->bd_meta_info);



	if (!bdev_is_partition(bdev))

	if (!bdev_is_partition(bdev)) {

		if (bdev->bd_disk && bdev->bd_disk->bdi)

			bdi_put(bdev->bd_disk->bdi);

		kfree(bdev->bd_disk);

	}



	if (MAJOR(bdev->bd_dev) == BLOCK_EXT_MAJOR)

		blk_free_ext_minor(MINOR(bdev->bd_dev));
@@ -833,8 +836,6 @@ static void bdev_evict_inode(struct inode *inode) 
	truncate_inode_pages_final(&inode->i_data);

	invalidate_inode_buffers(inode); /* is it needed here? */

	clear_inode(inode);

	/* Detach inode from wb early as bdi_put() may free bdi->wb */

	inode_detach_wb(inode);

}



static const struct super_operations bdev_sops = {