* [PATCH] fs: writeback: fix use-after-free in __mark_inode_dirty()
[not found] <CGME20250728100434epcas5p3995d3444fcec14715c60f73e7a60b1c0@epcas5p3.samsung.com>
@ 2025-07-28 10:07 ` Jiufei Xue
2025-07-28 10:21 ` Jan Kara
2025-07-31 10:26 ` Christian Brauner
0 siblings, 2 replies; 3+ messages in thread
From: Jiufei Xue @ 2025-07-28 10:07 UTC (permalink / raw)
To: tj, jack; +Cc: cgroups, linux-fsdevel, linux-kernel, Jiufei Xue
An use-after-free issue occurred when __mark_inode_dirty() get the
bdi_writeback that was in the progress of switching.
CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1
......
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __mark_inode_dirty+0x124/0x418
lr : __mark_inode_dirty+0x118/0x418
sp : ffffffc08c9dbbc0
........
Call trace:
__mark_inode_dirty+0x124/0x418
generic_update_time+0x4c/0x60
file_modified+0xcc/0xd0
ext4_buffered_write_iter+0x58/0x124
ext4_file_write_iter+0x54/0x704
vfs_write+0x1c0/0x308
ksys_write+0x74/0x10c
__arm64_sys_write+0x1c/0x28
invoke_syscall+0x48/0x114
el0_svc_common.constprop.0+0xc0/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x40/0xe4
el0t_64_sync_handler+0x120/0x12c
el0t_64_sync+0x194/0x198
Root cause is:
systemd-random-seed kworker
----------------------------------------------------------------------
___mark_inode_dirty inode_switch_wbs_work_fn
spin_lock(&inode->i_lock);
inode_attach_wb
locked_inode_to_wb_and_lock_list
get inode->i_wb
spin_unlock(&inode->i_lock);
spin_lock(&wb->list_lock)
spin_lock(&inode->i_lock)
inode_io_list_move_locked
spin_unlock(&wb->list_lock)
spin_unlock(&inode->i_lock)
spin_lock(&old_wb->list_lock)
inode_do_switch_wbs
spin_lock(&inode->i_lock)
inode->i_wb = new_wb
spin_unlock(&inode->i_lock)
spin_unlock(&old_wb->list_lock)
wb_put_many(old_wb, nr_switched)
cgwb_release
old wb released
wb_wakeup_delayed() accesses wb,
then trigger the use-after-free
issue
Fix this race condition by holding inode spinlock until
wb_wakeup_delayed() finished.
Signed-off-by: Jiufei Xue <jiufei.xue@samsung.com>
---
fs/fs-writeback.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index cc57367fb..a07b8cf73 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -2608,10 +2608,6 @@ void __mark_inode_dirty(struct inode *inode, int flags)
wakeup_bdi = inode_io_list_move_locked(inode, wb,
dirty_list);
- spin_unlock(&wb->list_lock);
- spin_unlock(&inode->i_lock);
- trace_writeback_dirty_inode_enqueue(inode);
-
/*
* If this is the first dirty inode for this bdi,
* we have to wake-up the corresponding bdi thread
@@ -2621,6 +2617,11 @@ void __mark_inode_dirty(struct inode *inode, int flags)
if (wakeup_bdi &&
(wb->bdi->capabilities & BDI_CAP_WRITEBACK))
wb_wakeup_delayed(wb);
+
+ spin_unlock(&wb->list_lock);
+ spin_unlock(&inode->i_lock);
+ trace_writeback_dirty_inode_enqueue(inode);
+
return;
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] fs: writeback: fix use-after-free in __mark_inode_dirty()
2025-07-28 10:07 ` [PATCH] fs: writeback: fix use-after-free in __mark_inode_dirty() Jiufei Xue
@ 2025-07-28 10:21 ` Jan Kara
2025-07-31 10:26 ` Christian Brauner
1 sibling, 0 replies; 3+ messages in thread
From: Jan Kara @ 2025-07-28 10:21 UTC (permalink / raw)
To: Jiufei Xue; +Cc: tj, jack, cgroups, linux-fsdevel, linux-kernel
On Mon 28-07-25 18:07:15, Jiufei Xue wrote:
> An use-after-free issue occurred when __mark_inode_dirty() get the
> bdi_writeback that was in the progress of switching.
>
> CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1
> ......
> pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : __mark_inode_dirty+0x124/0x418
> lr : __mark_inode_dirty+0x118/0x418
> sp : ffffffc08c9dbbc0
> ........
> Call trace:
> __mark_inode_dirty+0x124/0x418
> generic_update_time+0x4c/0x60
> file_modified+0xcc/0xd0
> ext4_buffered_write_iter+0x58/0x124
> ext4_file_write_iter+0x54/0x704
> vfs_write+0x1c0/0x308
> ksys_write+0x74/0x10c
> __arm64_sys_write+0x1c/0x28
> invoke_syscall+0x48/0x114
> el0_svc_common.constprop.0+0xc0/0xe0
> do_el0_svc+0x1c/0x28
> el0_svc+0x40/0xe4
> el0t_64_sync_handler+0x120/0x12c
> el0t_64_sync+0x194/0x198
>
> Root cause is:
>
> systemd-random-seed kworker
> ----------------------------------------------------------------------
> ___mark_inode_dirty inode_switch_wbs_work_fn
>
> spin_lock(&inode->i_lock);
> inode_attach_wb
> locked_inode_to_wb_and_lock_list
> get inode->i_wb
> spin_unlock(&inode->i_lock);
> spin_lock(&wb->list_lock)
> spin_lock(&inode->i_lock)
> inode_io_list_move_locked
> spin_unlock(&wb->list_lock)
> spin_unlock(&inode->i_lock)
> spin_lock(&old_wb->list_lock)
> inode_do_switch_wbs
> spin_lock(&inode->i_lock)
> inode->i_wb = new_wb
> spin_unlock(&inode->i_lock)
> spin_unlock(&old_wb->list_lock)
> wb_put_many(old_wb, nr_switched)
> cgwb_release
> old wb released
> wb_wakeup_delayed() accesses wb,
> then trigger the use-after-free
> issue
>
> Fix this race condition by holding inode spinlock until
> wb_wakeup_delayed() finished.
>
> Signed-off-by: Jiufei Xue <jiufei.xue@samsung.com>
Looks good! Thanks for the fix. Feel free to add:
Reviewed-by: Jan Kara <jack@suse.cz>
Honza
> ---
> fs/fs-writeback.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
> index cc57367fb..a07b8cf73 100644
> --- a/fs/fs-writeback.c
> +++ b/fs/fs-writeback.c
> @@ -2608,10 +2608,6 @@ void __mark_inode_dirty(struct inode *inode, int flags)
> wakeup_bdi = inode_io_list_move_locked(inode, wb,
> dirty_list);
>
> - spin_unlock(&wb->list_lock);
> - spin_unlock(&inode->i_lock);
> - trace_writeback_dirty_inode_enqueue(inode);
> -
> /*
> * If this is the first dirty inode for this bdi,
> * we have to wake-up the corresponding bdi thread
> @@ -2621,6 +2617,11 @@ void __mark_inode_dirty(struct inode *inode, int flags)
> if (wakeup_bdi &&
> (wb->bdi->capabilities & BDI_CAP_WRITEBACK))
> wb_wakeup_delayed(wb);
> +
> + spin_unlock(&wb->list_lock);
> + spin_unlock(&inode->i_lock);
> + trace_writeback_dirty_inode_enqueue(inode);
> +
> return;
> }
> }
> --
> 2.43.0
>
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] fs: writeback: fix use-after-free in __mark_inode_dirty()
2025-07-28 10:07 ` [PATCH] fs: writeback: fix use-after-free in __mark_inode_dirty() Jiufei Xue
2025-07-28 10:21 ` Jan Kara
@ 2025-07-31 10:26 ` Christian Brauner
1 sibling, 0 replies; 3+ messages in thread
From: Christian Brauner @ 2025-07-31 10:26 UTC (permalink / raw)
To: tj, jack, Jiufei Xue
Cc: Christian Brauner, cgroups, linux-fsdevel, linux-kernel
On Mon, 28 Jul 2025 18:07:15 +0800, Jiufei Xue wrote:
> An use-after-free issue occurred when __mark_inode_dirty() get the
> bdi_writeback that was in the progress of switching.
>
> CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1
> ......
> pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : __mark_inode_dirty+0x124/0x418
> lr : __mark_inode_dirty+0x118/0x418
> sp : ffffffc08c9dbbc0
> ........
> Call trace:
> __mark_inode_dirty+0x124/0x418
> generic_update_time+0x4c/0x60
> file_modified+0xcc/0xd0
> ext4_buffered_write_iter+0x58/0x124
> ext4_file_write_iter+0x54/0x704
> vfs_write+0x1c0/0x308
> ksys_write+0x74/0x10c
> __arm64_sys_write+0x1c/0x28
> invoke_syscall+0x48/0x114
> el0_svc_common.constprop.0+0xc0/0xe0
> do_el0_svc+0x1c/0x28
> el0_svc+0x40/0xe4
> el0t_64_sync_handler+0x120/0x12c
> el0t_64_sync+0x194/0x198
>
> [...]
Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.
Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.
It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.
Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.
tree: https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes
[1/1] fs: writeback: fix use-after-free in __mark_inode_dirty()
https://git.kernel.org/vfs/vfs/c/f8371b50ceaa
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-07-31 10:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <CGME20250728100434epcas5p3995d3444fcec14715c60f73e7a60b1c0@epcas5p3.samsung.com>
2025-07-28 10:07 ` [PATCH] fs: writeback: fix use-after-free in __mark_inode_dirty() Jiufei Xue
2025-07-28 10:21 ` Jan Kara
2025-07-31 10:26 ` Christian Brauner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).