On Wed, Apr 14, 2021 at 09:47:37PM +0800, Zhang Yi wrote: > There still exist a use after free issue when accessing the journal > structure and ext4_sb_info structure on freeing bdev buffers in > bdev_try_to_free_page(). The problem is bdev_try_to_free_page() could be > raced by ext4_put_super(), it dose freeing sb->s_fs_info and > sbi->s_journal while release page progress are still accessing them. > So it could end up trigger use-after-free or NULL pointer dereference. I think the right fix is to not even call into ->bdev_try_to_free_page unless the superblock is active.
