In blkdev_releasepage() we access the superblock structure directly, it
could be raced by umount filesystem on destroy superblock in put_super(),
and end up triggering a use after free issue.
drop cache umount filesystem
bdev_try_to_free_page()
get superblock
deactivate_locked_super()
...
put_super() and free sb by destroy_work
access superblock <-- trigger use after free
This issue doesn't trigger easily in general because we get page locked
when invoking bdev_try_to_free_page(), and when umount filesystem the
kill_block_super()->..->kill_bdev()->truncate_inode_pages_range()
procedure wait on page unlock, but it's not a guarantee. Fix this race
by use RCU to protect superblock in blkdev_releasepage().
Fixes: 87d8fe1ee6b8 ("add releasepage hooks to block devices which can be used by file systems")
Reported-by: Jan Kara <jack@xxxxxxx>
Signed-off-by: Zhang Yi <yi.zhang@xxxxxxxxxx>
---
fs/block_dev.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 5ed79a9063f6..cb84f347fb04 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1734,11 +1734,14 @@ EXPORT_SYMBOL_GPL(blkdev_read_iter);
*/
static int blkdev_releasepage(struct page *page, gfp_t wait)
{
- struct super_block *super = BDEV_I(page->mapping->host)->bdev.bd_super;
+ struct super_block *super;
int ret = 0;
+ rcu_read_lock();
+ super = READ_ONCE(BDEV_I(page->mapping->host)->bdev.bd_super);
if (super && super->s_op->bdev_try_to_free_page)
ret = super->s_op->bdev_try_to_free_page(super, page, wait);
+ rcu_read_unlock();
if (!ret)
return try_to_free_buffers(page);
return 0;
--
2.25.4
