From patchwork Tue Jun 8 23:02:20 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roman Gushchin X-Patchwork-Id: 12308387 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79EC3C4743F for ; Tue, 8 Jun 2021 23:07:58 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 16AF56135D for ; Tue, 8 Jun 2021 23:07:58 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 16AF56135D Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=fb.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A74326B006E; Tue, 8 Jun 2021 19:07:57 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A269A6B0070; Tue, 8 Jun 2021 19:07:57 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7DB0B6B0071; Tue, 8 Jun 2021 19:07:57 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0201.hostedemail.com [216.40.44.201]) by kanga.kvack.org (Postfix) with ESMTP id 4AD3B6B006E for ; Tue, 8 Jun 2021 19:07:57 -0400 (EDT) Received: from smtpin06.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id E49BD180AD815 for ; Tue, 8 Jun 2021 23:07:56 +0000 (UTC) X-FDA: 78232096152.06.062045C Received: from mx0a-00082601.pphosted.com (mx0b-00082601.pphosted.com [67.231.153.30]) by imf17.hostedemail.com (Postfix) with ESMTP id D5E2841449E4 for ; Tue, 8 Jun 2021 23:07:53 +0000 (UTC) Received: from pps.filterd (m0089730.ppops.net [127.0.0.1]) by m0089730.ppops.net (8.16.0.43/8.16.0.43) with SMTP id 158N59uL002186 for ; Tue, 8 Jun 2021 16:07:55 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=facebook; bh=Wat9OU0kdkYsu0broEQrIYlR9g8uY2amIQn7zLLGWCw=; b=X3N+3hI2zVA2eBExpz77q+Zqg8uVyD3H9fGk6mbYNV+QrhnceJrFYKrmPma1ppmkRG3h pr170e1V6oAiJ+lk4UBeMgniVTEcNvwBRiRC29h23o08EblmBTgQfZLiT1z/M6FBq4rC recGjnn3+n52FcAwsyC15A7ma0wJeJWMlOg= Received: from mail.thefacebook.com ([163.114.132.120]) by m0089730.ppops.net with ESMTP id 391nwp9svv-3 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Tue, 08 Jun 2021 16:07:55 -0700 Received: from intmgw002.46.prn1.facebook.com (2620:10d:c085:208::f) by mail.thefacebook.com (2620:10d:c085:11d::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Tue, 8 Jun 2021 16:07:53 -0700 Received: by devvm3388.prn0.facebook.com (Postfix, from userid 111017) id 3AF3182542CB; Tue, 8 Jun 2021 16:02:28 -0700 (PDT) From: Roman Gushchin To: Andrew Morton , Tejun Heo CC: , , , Alexander Viro , Jan Kara , Dennis Zhou , Dave Chinner , , Roman Gushchin , Jan Kara Subject: [PATCH v9 3/8] writeback, cgroup: increment isw_nr_in_flight before grabbing an inode Date: Tue, 8 Jun 2021 16:02:20 -0700 Message-ID: <20210608230225.2078447-4-guro@fb.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210608230225.2078447-1-guro@fb.com> References: <20210608230225.2078447-1-guro@fb.com> MIME-Version: 1.0 X-FB-Internal: Safe X-Proofpoint-ORIG-GUID: wzrT9l7TN2B3YQHS731hoU0kDlGaWGLM X-Proofpoint-GUID: wzrT9l7TN2B3YQHS731hoU0kDlGaWGLM X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391,18.0.761 definitions=2021-06-08_17:2021-06-04,2021-06-08 signatures=0 X-Proofpoint-Spam-Details: rule=fb_default_notspam policy=fb_default score=0 impostorscore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 adultscore=0 priorityscore=1501 bulkscore=0 mlxscore=0 malwarescore=0 phishscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000 definitions=main-2106080146 X-FB-Internal: deliver X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: D5E2841449E4 Authentication-Results: imf17.hostedemail.com; dkim=pass header.d=fb.com header.s=facebook header.b=X3N+3hI2; spf=pass (imf17.hostedemail.com: domain of "prvs=5793bd417c=guro@fb.com" designates 67.231.153.30 as permitted sender) smtp.mailfrom="prvs=5793bd417c=guro@fb.com"; dmarc=pass (policy=reject) header.from=fb.com X-Stat-Signature: 7cgqh83wxqroy61bmh9z15nyf177ty7o X-HE-Tag: 1623193673-990143 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: isw_nr_in_flight is used do determine whether the inode switch queue should be flushed from the umount path. Currently it's increased after grabbing an inode and even scheduling the switch work. It means the umount path can be walked past cleanup_offline_cgwb() with active inode references, which can result in a "Busy inodes after unmount." message and use-after-free issues (with inode->i_sb which gets freed). Fix it by incrementing isw_nr_in_flight before doing anything with the inode and decrementing in the case when switching wasn't scheduled. The problem hasn't yet been seen in the real life and was discovered by Jan Kara by looking into the code. Suggested-by: Jan Kara Signed-off-by: Roman Gushchin Reviewed-by: Jan Kara Signed-off-by: Roman Gushchin --- fs/fs-writeback.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c index b6fc13a4962d..4413e005c28c 100644 --- a/fs/fs-writeback.c +++ b/fs/fs-writeback.c @@ -505,6 +505,8 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) if (!isw) return; + atomic_inc(&isw_nr_in_flight); + /* find and pin the new wb */ rcu_read_lock(); memcg_css = css_from_id(new_wb_id, &memory_cgrp_subsys); @@ -535,11 +537,10 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) * Let's continue after I_WB_SWITCH is guaranteed to be visible. */ call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn); - - atomic_inc(&isw_nr_in_flight); return; out_free: + atomic_dec(&isw_nr_in_flight); if (isw->new_wb) wb_put(isw->new_wb); kfree(isw);