Received-SPF: pass (google.com: domain of linux-ext4-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 15 Apr 2021 15:52:35 +0100
From:   Christoph Hellwig <hch@infradead.org>
To:     Zhang Yi <yi.zhang@huawei.com>
Cc:     linux-ext4@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        tytso@mit.edu, adilger.kernel@dilger.ca, jack@suse.cz,
        yukuai3@huawei.com
Subject: Re: [RFC PATCH v2 7/7] ext4: fix race between blkdev_releasepage()
 and ext4_put_super()
Message-ID: <20210415145235.GD2069063@infradead.org>
References: <20210414134737.2366971-1-yi.zhang@huawei.com>
 <20210414134737.2366971-8-yi.zhang@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210414134737.2366971-8-yi.zhang@huawei.com>
Precedence: bulk

On Wed, Apr 14, 2021 at 09:47:37PM +0800, Zhang Yi wrote:
> There still exist a use after free issue when accessing the journal
> structure and ext4_sb_info structure on freeing bdev buffers in
> bdev_try_to_free_page(). The problem is bdev_try_to_free_page() could be
> raced by ext4_put_super(), it dose freeing sb->s_fs_info and
> sbi->s_journal while release page progress are still accessing them.
> So it could end up trigger use-after-free or NULL pointer dereference.

I think the right fix is to not even call into ->bdev_try_to_free_page
unless the superblock is active.