Jiufei Xue
bf89b1f87c
fs: writeback: fix use-after-free in __mark_inode_dirty()
[ Upstream commit d02d2c98d25793902f65803ab853b592c7a96b29 ]
An use-after-free issue occurred when __mark_inode_dirty() get the
bdi_writeback that was in the progress of switching.
CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1
......
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __mark_inode_dirty+0x124/0x418
lr : __mark_inode_dirty+0x118/0x418
sp : ffffffc08c9dbbc0
........
Call trace:
__mark_inode_dirty+0x124/0x418
generic_update_time+0x4c/0x60
file_modified+0xcc/0xd0
ext4_buffered_write_iter+0x58/0x124
ext4_file_write_iter+0x54/0x704
vfs_write+0x1c0/0x308
ksys_write+0x74/0x10c
__arm64_sys_write+0x1c/0x28
invoke_syscall+0x48/0x114
el0_svc_common.constprop.0+0xc0/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x40/0xe4
el0t_64_sync_handler+0x120/0x12c
el0t_64_sync+0x194/0x198
Root cause is:
systemd-random-seed kworker
----------------------------------------------------------------------
___mark_inode_dirty inode_switch_wbs_work_fn
spin_lock(&inode->i_lock);
inode_attach_wb
locked_inode_to_wb_and_lock_list
get inode->i_wb
spin_unlock(&inode->i_lock);
spin_lock(&wb->list_lock)
spin_lock(&inode->i_lock)
inode_io_list_move_locked
spin_unlock(&wb->list_lock)
spin_unlock(&inode->i_lock)
spin_lock(&old_wb->list_lock)
inode_do_switch_wbs
spin_lock(&inode->i_lock)
inode->i_wb = new_wb
spin_unlock(&inode->i_lock)
spin_unlock(&old_wb->list_lock)
wb_put_many(old_wb, nr_switched)
cgwb_release
old wb released
wb_wakeup_delayed() accesses wb,
then trigger the use-after-free
issue
Fix this race condition by holding inode spinlock until
wb_wakeup_delayed() finished.
Signed-off-by: Jiufei Xue <jiufei.xue@samsung.com>
Link: https://lore.kernel.org/20250728100715.3863241-1-jiufei.xue@samsung.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-09-09 18:56:20 +02:00
..
2024-11-22 15:38:37 +01:00
2023-08-29 20:21:42 -07:00
2025-04-10 14:37:37 +02:00
2025-03-07 16:45:38 +01:00
2023-08-28 11:39:14 -07:00
2023-08-29 20:21:42 -07:00
2023-08-29 20:21:42 -07:00
2025-09-09 18:56:19 +02:00
2025-07-24 08:53:16 +02:00
2025-07-06 11:00:08 +02:00
2023-08-28 09:31:32 -07:00
2025-06-27 11:08:42 +01:00
2024-08-19 06:04:25 +02:00
2025-08-28 16:28:40 +02:00
2024-01-20 11:51:37 +01:00
2023-08-28 10:17:14 -07:00
2025-06-04 14:41:57 +02:00
2024-10-04 16:29:48 +02:00
2025-09-04 15:30:26 +02:00
2023-08-29 20:21:42 -07:00
2025-09-04 15:30:19 +02:00
2025-08-28 16:28:28 +02:00
2023-08-29 17:45:22 -04:00
2025-08-28 16:28:15 +02:00
2025-08-28 16:28:44 +02:00
2025-08-28 16:28:36 +02:00
2024-10-22 15:46:20 +02:00
2023-08-29 20:21:42 -07:00
2024-12-09 10:31:45 +01:00
2025-07-06 11:00:06 +02:00
2025-08-28 16:28:15 +02:00
2025-08-28 16:28:15 +02:00
2025-08-28 16:28:14 +02:00
2025-04-10 14:37:34 +02:00
2023-08-29 20:21:42 -07:00
2025-08-28 16:28:39 +02:00
2025-05-02 07:51:01 +02:00
2025-07-24 08:53:13 +02:00
2025-08-28 16:28:36 +02:00
2025-06-27 11:08:58 +01:00
2025-08-28 16:28:26 +02:00
2025-06-19 15:28:16 +02:00
2024-08-19 06:04:23 +02:00
2023-08-29 20:21:42 -07:00
2023-09-18 12:03:46 -07:00
2025-09-04 15:30:20 +02:00
2023-04-13 13:13:52 -07:00
2025-08-28 16:28:11 +02:00
2025-08-01 09:47:30 +01:00
2023-08-31 12:07:34 -05:00
2025-08-15 12:08:52 +02:00
2023-08-29 20:21:42 -07:00
2025-08-28 16:28:15 +02:00
2025-06-19 15:28:23 +02:00
2023-08-29 20:21:42 -07:00
2024-06-12 11:11:30 +02:00
2025-08-28 16:28:25 +02:00
2025-07-06 11:00:08 +02:00
2025-08-15 12:08:54 +02:00
2025-06-04 14:42:11 +02:00
2023-08-29 20:21:42 -07:00
2023-08-29 20:21:42 -07:00
2024-12-09 10:33:01 +01:00
2023-07-24 10:30:04 +02:00
2024-08-19 06:04:26 +02:00
2024-08-19 06:04:25 +02:00
2025-09-04 15:30:28 +02:00
2025-08-28 16:28:43 +02:00
2024-04-27 17:11:41 +02:00
2024-04-13 13:07:34 +02:00
2025-08-28 16:28:15 +02:00
2025-02-08 09:52:28 +01:00
2025-08-28 16:28:15 +02:00
2023-08-29 20:21:42 -07:00
2024-12-14 20:00:20 +01:00
2025-03-22 12:50:41 -07:00
2024-06-16 13:47:33 +02:00
2025-09-04 15:30:29 +02:00
2024-02-23 09:25:13 +01:00
2024-04-03 15:28:44 +02:00
2025-07-10 16:03:18 +02:00
2023-08-28 10:17:14 -07:00
2023-08-11 09:04:57 +02:00
2024-08-29 17:33:33 +02:00
2025-05-22 14:12:12 +02:00
2025-02-17 09:40:16 +01:00
2024-08-29 17:33:27 +02:00
2025-08-28 16:28:44 +02:00
2023-05-15 09:42:01 +02:00
2025-06-04 14:42:24 +02:00
2023-05-17 09:16:59 +02:00
2024-11-08 16:28:19 +01:00
2024-07-25 09:50:54 +02:00
2023-06-28 10:28:11 -07:00
2023-08-18 10:12:11 -07:00
2023-07-11 11:41:34 +02:00
2025-08-28 16:28:12 +02:00
2025-04-10 14:37:44 +02:00
2024-10-04 16:29:56 +02:00
2024-08-19 06:04:28 +02:00
2025-02-08 09:51:42 +01:00
2025-08-28 16:28:50 +02:00
2025-06-19 15:28:43 +02:00
2023-10-12 18:53:36 +03:00
2022-12-01 10:46:54 -05:00
2023-08-21 13:46:25 -07:00
2025-09-09 18:56:20 +02:00
2023-08-14 18:48:02 +02:00
2023-01-19 09:24:28 +01:00
2024-12-09 10:31:41 +01:00
2023-08-29 20:21:42 -07:00
2024-01-31 16:18:54 -08:00
2025-04-25 10:45:46 +02:00
2023-08-23 14:17:43 -07:00
2023-08-19 12:12:12 +02:00
2025-08-28 16:28:15 +02:00
2024-07-27 11:34:10 +02:00
2023-08-02 09:13:09 -06:00
2022-12-08 21:49:25 -05:00
2023-01-19 09:24:30 +01:00
2023-04-18 16:30:02 -07:00
2025-03-22 12:50:44 -07:00
2025-08-28 16:28:44 +02:00
2023-07-13 10:28:04 +02:00
2024-11-01 01:58:32 +01:00
2024-04-10 16:35:57 +02:00
2023-05-19 04:30:22 +02:00
2023-05-19 04:30:22 +02:00
2023-07-13 10:28:04 +02:00
2023-05-24 08:42:16 -06:00
2023-08-15 08:32:45 +02:00
2023-08-06 15:08:35 +02:00
2023-05-24 11:03:59 +02:00
2025-03-22 12:50:37 -07:00
2022-11-25 13:01:55 -05:00
2025-05-02 07:50:45 +02:00
2023-07-13 10:28:04 +02:00
2023-12-03 07:33:03 +01:00
2023-05-17 15:20:17 +02:00
2024-08-19 06:04:25 +02:00
2023-05-23 21:43:26 -07:00
2025-04-25 10:45:31 +02:00
2023-02-20 11:53:11 -08:00
2025-06-27 11:08:57 +01:00