Hi, all We have reported a use-after-free crash for bdi device in __blkg_prfill_rwstat(). The bug is caused by printing device kobj->name while the device and kobj->name has been freed by bdi_unregister(). In fact, commit 68f23b8906 "memcg: fix a crash in wb_workfn when a device disappears" has tried to address the issue, but the code is till somewhat racy after that commit. In this patchset, we try to protect bdi->dev with spinlock, and copy device name into buffer, avoiding use-after-free. V2: https://www.spinics.net/lists/linux-fsdevel/msg163206.html Rry to protect device lifetime with RCU. V1: https://www.spinics.net/lists/linux-block/msg49693.html Add a new spinlock and copy kobj->name into caller buffer. Or using synchronize_rcu() to wait until reader complete. Yufen Yu (4): bdi: use bdi_dev_name() to get device name bdi: add new bdi_get_dev_name() bdi: replace bdi_dev_name() with bdi_get_dev_name() bdi: protect bdi->dev with spinlock block/bfq-iosched.c | 6 +++-- block/blk-cgroup-rwstat.c | 6 +++-- block/blk-cgroup.c | 19 +++++----------- block/blk-iocost.c | 14 +++++++----- block/blk-iolatency.c | 5 +++-- block/blk-throttle.c | 6 +++-- fs/ceph/debugfs.c | 2 +- fs/fs-writeback.c | 4 +++- include/linux/backing-dev-defs.h | 1 + include/linux/backing-dev.h | 23 +++++++++++++++++++ include/linux/blk-cgroup.h | 1 - include/trace/events/wbt.h | 8 +++---- include/trace/events/writeback.h | 38 ++++++++++++++------------------ mm/backing-dev.c | 9 ++++++-- 14 files changed, 85 insertions(+), 57 deletions(-) -- 2.17.2
