Messages in this thread Patch in this message | | | Date | Sun, 13 Nov 2022 17:24:39 +0200 | Subject | [PATCH] fs: do not push freeing inode to b_dirty_time list | From | Svyatoslav Feldsherov <> |
| |
After commit cbfecb927f42 ("fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE") writeiback_single_inode can push inode with I_DIRTY_TIME set to b_dirty_time list. In case of freeing inode with I_DIRTY_TIME set this can happened after deletion of inode io_list at evict. Stack trace is following.
evict fat_evict_inode fat_truncate_blocks fat_flush_inodes writeback_inode sync_inode_metadata writeback_single_inode
This will lead to use after free in flusher thread.
Fixes: cbfecb927f42 ("fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE") Reported-by: syzbot+6ba92bd00d5093f7e371@syzkaller.appspotmail.com Signed-off-by: Svyatoslav Feldsherov <feldsherov@google.com> --- fs/fs-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c index 443f83382b9b..31c93cbdb3fe 100644 --- a/fs/fs-writeback.c +++ b/fs/fs-writeback.c @@ -1718,7 +1718,7 @@ static int writeback_single_inode(struct inode *inode, */ if (!(inode->i_state & I_DIRTY_ALL)) inode_cgwb_move_to_attached(inode, wb); - else if (!(inode->i_state & I_SYNC_QUEUED)) { + else if (!(inode->i_state & (I_SYNC_QUEUED | I_FREEING))) { if ((inode->i_state & I_DIRTY)) redirty_tail_locked(inode, wb); else if (inode->i_state & I_DIRTY_TIME) { -- 2.38.1.431.g37b22c650d-goog
| |