Add check that freed inode is not left on dirty list. ext4 had a bug that could do that resulting in difficult to debug use-after-free issues with inodes. Also add a comment in evict() explaining why dirty list handling there is safe. Signed-off-by: Jan Kara <jack@xxxxxxx> --- fs/inode.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/inode.c b/fs/inode.c index 93d9252a00ab..15260b6d5590 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -534,6 +534,7 @@ void clear_inode(struct inode *inode) BUG_ON(!(inode->i_state & I_FREEING)); BUG_ON(inode->i_state & I_CLEAR); BUG_ON(!list_empty(&inode->i_wb_list)); + BUG_ON(!list_empty(&inode->i_io_list)); /* don't need i_lock here, no concurrent mods to i_state */ inode->i_state = I_FREEING | I_CLEAR; } @@ -559,6 +560,13 @@ static void evict(struct inode *inode) BUG_ON(!(inode->i_state & I_FREEING)); BUG_ON(!list_empty(&inode->i_lru)); + /* + * We are the only holder of the inode so it cannot be marked dirty. + * Flusher thread won't start new writeback because I_FREEING is set + * but there can be still redirty_tail() running from + * writeback_sb_inodes(). However this list_move() cannot result in + * list_empty() returning true. + */ if (!list_empty(&inode->i_io_list)) inode_io_list_del(inode); -- 2.16.4
