Received-SPF: pass (google.com: domain of linux-ext4-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Zhang Yi <yi.zhang@huawei.com>
To:     <linux-ext4@vger.kernel.org>
CC:     <linux-fsdevel@vger.kernel.org>, <tytso@mit.edu>,
        <adilger.kernel@dilger.ca>, <jack@suse.cz>, <yi.zhang@huawei.com>,
        <yukuai3@huawei.com>
Subject: [RFC PATCH v2 5/7] ext4: use RCU to protect accessing superblock in blkdev_releasepage()
Date:   Wed, 14 Apr 2021 21:47:35 +0800
Message-ID: <20210414134737.2366971-6-yi.zhang@huawei.com>
In-Reply-To: <20210414134737.2366971-1-yi.zhang@huawei.com>
References: <20210414134737.2366971-1-yi.zhang@huawei.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7BIT
Content-Type:   text/plain; charset=US-ASCII
Precedence: bulk

In blkdev_releasepage() we access the superblock structure directly, it
could be raced by umount filesystem on destroy superblock in put_super(),
and end up triggering a use after free issue.

drop cache                  umount filesystem
bdev_try_to_free_page()
 get superblock
                             deactivate_locked_super()
                               ...
                               put_super() and free sb by destroy_work
 access superblock  <-- trigger use after free

This issue doesn't trigger easily in general because we get page locked
when invoking bdev_try_to_free_page(), and when umount filesystem the
kill_block_super()->..->kill_bdev()->truncate_inode_pages_range()
procedure wait on page unlock, but it's not a guarantee. Fix this race
by use RCU to protect superblock in blkdev_releasepage().

Fixes: 87d8fe1ee6b8 ("add releasepage hooks to block devices which can be used by file systems")
Reported-by: Jan Kara <jack@suse.cz>
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
---
 fs/block_dev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/block_dev.c b/fs/block_dev.c
index 5ed79a9063f6..cb84f347fb04 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1734,11 +1734,14 @@ EXPORT_SYMBOL_GPL(blkdev_read_iter);
  */
 static int blkdev_releasepage(struct page *page, gfp_t wait)
 {
-	struct super_block *super = BDEV_I(page->mapping->host)->bdev.bd_super;
+	struct super_block *super;
 	int ret = 0;
 
+	rcu_read_lock();
+	super = READ_ONCE(BDEV_I(page->mapping->host)->bdev.bd_super);
 	if (super && super->s_op->bdev_try_to_free_page)
 		ret = super->s_op->bdev_try_to_free_page(super, page, wait);
+	rcu_read_unlock();
 	if (!ret)
 		return try_to_free_buffers(page);
 	return 0;
-- 
2.25.4