writeback, cgroup: fix premature wb_put() in locked_inode_to_wb_and_lock_list()
authorTejun Heo <tj@kernel.org>
Fri, 18 Mar 2016 17:50:03 +0000 (13:50 -0400)
committerJens Axboe <axboe@fb.com>
Sun, 20 Mar 2016 15:44:18 +0000 (09:44 -0600)
commit614a4e3773148a31f58dc174bbf578ceb63510c2
treed4f4a24bcdb54e92b6e800fd72c073f0bf08f2d2
parent897bb0c7f1ea82d7cc882b19790b5e1df00ffc29
writeback, cgroup: fix premature wb_put() in locked_inode_to_wb_and_lock_list()

locked_inode_to_wb_and_lock_list() wb_get()'s the wb associated with
the target inode, unlocks inode, locks the wb's list_lock and verifies
that the inode is still associated with the wb.  To prevent the wb
going away between dropping inode lock and acquiring list_lock, the wb
is pinned while inode lock is held.  The wb reference is put right
after acquiring list_lock citing that the wb won't be dereferenced
anymore.

This isn't true.  If the inode is still associated with the wb, the
inode has reference and it's safe to return the wb; however, if inode
has been switched, the wb still needs to be unlocked which is a
dereference and can lead to use-after-free if it it races with wb
destruction.

Fix it by putting the reference after releasing list_lock.

Signed-off-by: Tejun Heo <tj@kernel.org>
Fixes: 87e1d789bf55 ("writeback: implement [locked_]inode_to_wb_and_lock_list()")
Cc: stable@vger.kernel.org # v4.2+
Tested-by: Tahsin Erdogan <tahsin@google.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
fs/fs-writeback.c