xfs: save ailp before dropping the AIL lock in push callbacks

commit 394d70b86fae9fe865e7e6d9540b7696f73aa9b6 upstream.

In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock
is dropped to perform buffer IO. Once the cluster buffer no longer
protects the log item from reclaim, the log item may be freed by
background reclaim or the dquot shrinker. The subsequent spin_lock()
call dereferences lip->li_ailp, which is a use-after-free.

Fix this by saving the ailp pointer in a local variable while the AIL
lock is held and the log item is guaranteed to be valid.

Reported-by: syzbot+652af2b3c5569c4ab63c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=652af2b3c5569c4ab63c
Fixes: 90c60e164012 ("xfs: xfs_iflush() is no longer necessary")
Cc: stable@vger.kernel.org # v5.9
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Yuto Ohnuki <ytohnuki@amazon.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/xfs/xfs_dquot_item.c b/fs/xfs/xfs_dquot_item.c
index 7d19091215b08030a22c6cad064dec29e38fe873..74449aec81edce67c869a74d845f8974bdd4e26d 100644 (file)
--- a/fs/xfs/xfs_dquot_item.c
+++ b/fs/xfs/xfs_dquot_item.c
@@ -125,6 +125,7 @@ xfs_qm_dquot_logitem_push(
 {
        struct xfs_dquot        *dqp = DQUOT_ITEM(lip)->qli_dquot;
        struct xfs_buf          *bp = lip->li_buf;
+       struct xfs_ail          *ailp = lip->li_ailp;
        uint                    rval = XFS_ITEM_SUCCESS;
        int                     error;
 
@@ -153,7 +154,7 @@ xfs_qm_dquot_logitem_push(
                goto out_unlock;
        }
 
-       spin_unlock(&lip->li_ailp->ail_lock);
+       spin_unlock(&ailp->ail_lock);
 
        error = xfs_qm_dqflush(dqp, &bp);
        if (!error) {
@@ -163,7 +164,11 @@ xfs_qm_dquot_logitem_push(
        } else if (error == -EAGAIN)
                rval = XFS_ITEM_LOCKED;
 
-       spin_lock(&lip->li_ailp->ail_lock);
+       /*
+        * The buffer no longer protects the log item from reclaim, so
+        * do not reference lip after this point.
+        */
+       spin_lock(&ailp->ail_lock);
 out_unlock:
        xfs_dqunlock(dqp);
        return rval;

diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index a734ca8d8f03c4cf7dc6e32ec3b6d76588197149..36f25a138e3bb92b14f52fb2443599563895302f 100644 (file)
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -727,6 +727,7 @@ xfs_inode_item_push(
        struct xfs_inode_log_item *iip = INODE_ITEM(lip);
        struct xfs_inode        *ip = iip->ili_inode;
        struct xfs_buf          *bp = lip->li_buf;
+       struct xfs_ail          *ailp = lip->li_ailp;
        uint                    rval = XFS_ITEM_SUCCESS;
        int                     error;
 
@@ -749,7 +750,7 @@ xfs_inode_item_push(
        if (!xfs_buf_trylock(bp))
                return XFS_ITEM_LOCKED;
 
-       spin_unlock(&lip->li_ailp->ail_lock);
+       spin_unlock(&ailp->ail_lock);
 
        /*
         * We need to hold a reference for flushing the cluster buffer as it may
@@ -773,7 +774,11 @@ xfs_inode_item_push(
                rval = XFS_ITEM_LOCKED;
        }
 
-       spin_lock(&lip->li_ailp->ail_lock);
+       /*
+        * The buffer no longer protects the log item from reclaim, so
+        * do not reference lip after this point.
+        */
+       spin_lock(&ailp->ail_lock);
        return rval;
 }