diff mbox series

fs: Check freed inode is not left on dirty list

Message ID 20200514182617.20087-1-jack@suse.cz (mailing list archive)
State New, archived
Headers show
Series fs: Check freed inode is not left on dirty list | expand

Commit Message

Jan Kara May 14, 2020, 6:26 p.m. UTC 
Add check that freed inode is not left on dirty list. ext4 had a bug
that could do that resulting in difficult to debug use-after-free issues
with inodes. Also add a comment in evict() explaining why dirty list
handling there is safe.

Signed-off-by: Jan Kara <jack@suse.cz>
---
 fs/inode.c                    | 8 ++++++++
 1 file changed, 8 insertions(+)
diff mbox series

Patch

diff --git a/fs/inode.c b/fs/inode.c
index 93d9252a00ab..15260b6d5590 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -534,6 +534,7 @@  void clear_inode(struct inode *inode)
 	BUG_ON(!(inode->i_state & I_FREEING));
 	BUG_ON(inode->i_state & I_CLEAR);
 	BUG_ON(!list_empty(&inode->i_wb_list));
+	BUG_ON(!list_empty(&inode->i_io_list));
 	/* don't need i_lock here, no concurrent mods to i_state */
 	inode->i_state = I_FREEING | I_CLEAR;
 }
@@ -559,6 +560,13 @@  static void evict(struct inode *inode)
 	BUG_ON(!(inode->i_state & I_FREEING));
 	BUG_ON(!list_empty(&inode->i_lru));
 
+	/*
+	 * We are the only holder of the inode so it cannot be marked dirty.
+	 * Flusher thread won't start new writeback because I_FREEING is set
+	 * but there can be still redirty_tail() running from
+	 * writeback_sb_inodes(). However this list_move() cannot result in
+	 * list_empty() returning true.
+	 */
 	if (!list_empty(&inode->i_io_list))
 		inode_io_list_del(inode);