• Jan Kara's avatar
    bdi: Fix another oops in wb_workfn() · 3ee7e869
    Jan Kara authored
    syzbot is reporting NULL pointer dereference at wb_workfn() [1] due to
    wb->bdi->dev being NULL. And Dmitry confirmed that wb->state was
    WB_shutting_down after wb->bdi->dev became NULL. This indicates that
    unregister_bdi() failed to call wb_shutdown() on one of wb objects.
    
    The problem is in cgwb_bdi_unregister() which does cgwb_kill() and thus
    drops bdi's reference to wb structures before going through the list of
    wbs again and calling wb_shutdown() on each of them. This way the loop
    iterating through all wbs can easily miss a wb if that wb has already
    passed through cgwb_remove_from_bdi_list() called from wb_shutdown()
    from cgwb_release_workfn() and as a result fully shutdown bdi although
    wb_workfn() for this wb structure is still running. In fact there are
    also other ways cgwb_bdi_unregister() can race with
    cgwb_release_workfn() leading e.g. to use-after-free issues:
    
    CPU1                            CPU2
                                    cgwb_bdi_unregister()
                                      cgwb_kill(*slot);
    
    cgwb_release()
      queue_work(cgwb_release_wq, &wb->release_work);
    cgwb_release_workfn()
                                      wb = list_first_entry(&bdi->wb_list, ...)
                                      spin_unlock_irq(&cgwb_lock);
      wb_shutdown(wb);
      ...
      kfree_rcu(wb, rcu);
                                      wb_shutdown(wb); -> oops use-after-free
    
    We solve these issues by synchronizing writeback structure shutdown from
    cgwb_bdi_unregister() with cgwb_release_workfn() using a new mutex. That
    way we also no longer need synchronization using WB_shutting_down as the
    mutex provides it for CONFIG_CGROUP_WRITEBACK case and without
    CONFIG_CGROUP_WRITEBACK wb_shutdown() can be called only once from
    bdi_unregister().
    Reported-by: 's avatarsyzbot <syzbot+4a7438e774b21ddd8eca@syzkaller.appspotmail.com>
    Acked-by: 's avatarTejun Heo <tj@kernel.org>
    Signed-off-by: 's avatarJan Kara <jack@suse.cz>
    Signed-off-by: 's avatarJens Axboe <axboe@kernel.dk>
    3ee7e869
backing-dev.c 26.8 KB