>From cede4bc05f7a9a38f21b5943c11592fdb098b4f4 Mon Sep 17 00:00:00 2001 From: Jan Kara Date: Fri, 5 Apr 2024 13:57:28 +0200 Subject: [PATCH] writeback: Fix memory corruption in writeback code Commit 167d6693deb3 ("fs/writeback: bail out if there is no more inodes for IO and queued once") made the loop in wb_writeback() continue, even if we didn't have any inodes in b_more_io list when we didn't queue any inodes into b_io list yet. Conceptually this is fine however the loop in this case takes the first inode from b_more_io list and waits for writeback on it to complete. When b_more_io list is empty, this results in accesses beyond the wb->b_more_io list head corrupting struct wb_writeback and memory beyond it. Fix the problem by directly restarting the loop in this case instead of going through waiting on inode in b_more_io list. Reported-by: syzbot+7b219b86935220db6dd8@syzkaller.appspotmail.com Fixes: 167d6693deb3 ("fs/writeback: bail out if there is no more inodes for IO and queued once") Signed-off-by: Jan Kara --- fs/fs-writeback.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c index f7ed4192d0f8..92a5b8283528 100644 --- a/fs/fs-writeback.c +++ b/fs/fs-writeback.c @@ -2137,7 +2137,7 @@ static long wb_writeback(struct bdi_writeback *wb, * mean the overall work is done. So we keep looping as long * as made some progress on cleaning pages or inodes. */ - if (progress) { + if (progress || !queued) { spin_unlock(&wb->list_lock); continue; } @@ -2145,7 +2145,7 @@ static long wb_writeback(struct bdi_writeback *wb, /* * No more inodes for IO, bail */ - if (list_empty(&wb->b_more_io) && queued) { + if (list_empty(&wb->b_more_io)) { spin_unlock(&wb->list_lock); break; } -- 2.35.3