Re: [PATCH] writeback: Fix use after free in inode_switch_wbs_work_fn()

[Tejun Heo <tj@kernel.org>]

On Mon, Apr 13, 2026 at 11:36:19AM +0200, Jan Kara wrote:
> inode_switch_wbs_work_fn() has a loop like:
> 
>   wb_get(new_wb);
>   while (1) {
>     list = llist_del_all(&new_wb->switch_wbs_ctxs);
>     /* Nothing to do? */
>     if (!list)
>       break;
>     ... process the items ...
>   }
> 
> Now adding of items to the list looks like:
> 
> wb_queue_isw()
>   if (llist_add(&isw->list, &wb->switch_wbs_ctxs))
>     queue_work(isw_wq, &wb->switch_work);
> 
> Because inode_switch_wbs_work_fn() loops when processing isw items, it
> can happen that wb->switch_work is pending while wb->switch_wbs_ctxs is
> empty. This is a problem because in that case wb can get freed (no isw
> items -> no wb reference) while the work is still pending causing
> use-after-free issues.
> 
> We cannot just fix this by cancelling work when freeing wb because that
> could still trigger problematic 0 -> 1 transitions on wb refcount due to
> wb_get() in inode_switch_wbs_work_fn(). It could be all handled with
> more careful code but that seems unnecessarily complex so let's avoid
> that until it is proven that the looping actually brings practical
> benefit. Just remove the loop from inode_switch_wbs_work_fn() instead.
> That way when wb_queue_isw() queues work, we are guaranteed we have
> added the first item to wb->switch_wbs_ctxs and nobody is going to
> remove it (and drop the wb reference it holds) until the queued work
> runs.
> 
> Fixes: e1b849cfa6b6 ("writeback: Avoid contention on wb->list_lock when switching inodes")
> CC: stable@vger.kernel.org
> Signed-off-by: Jan Kara <jack@suse.cz>

Oh man, that's too subtle.

Acked-by: Tejun Heo <tj@kernel.org>

Thanks.

-- 
tejun