Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 16d28918 authored by Jan Kara's avatar Jan Kara Committed by Ritesh Harjani
Browse files

block: Initialize bd_bdi on inode initialization 



So far we initialized bd_bdi only in bdget(). That is fine for normal
bdev inodes however for the special case of the root inode of
blockdev_superblock that function is never called and thus bd_bdi is
left uninitialized. As a result bdev_evict_inode() may oops doing
bdi_put(root->bd_bdi) on that inode as can be seen when doing:

mount -t bdev none /mnt

Fix the problem by initializing bd_bdi when first allocating the inode
and then reinitializing bd_bdi in bdev_evict_inode().

Thanks to syzkaller team for finding the problem.

Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Fixes: b1d2dc5659b4 ("block: Make blk_get_backing_dev_info() safe without open bdev")
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarJens Axboe <axboe@fb.com>
Change-Id: I9c34ca321ab311936946187ed21e25d67caf5ba5
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git


Git-commit: 7ee143f46cb1f58ee07194076b9a3e6ea3f27ad3
[riteshh@codeaurora.org: resolved merge conflicts]
Signed-off-by: default avatarRitesh Harjani <riteshh@codeaurora.org>
parent 9c197e78

fs/block_dev.c

+4 −2
Original line number Diff line number Diff line
@@ -532,6 +532,7 @@ static void init_once(void *foo) 
#ifdef CONFIG_SYSFS

	INIT_LIST_HEAD(&bdev->bd_holder_disks);

#endif

	bdev->bd_bdi = &noop_backing_dev_info;

	inode_init_once(&ei->vfs_inode);

	/* Initialize mutex for freeze. */

	mutex_init(&bdev->bd_fsfreeze_mutex);
@@ -557,8 +558,10 @@ static void bdev_evict_inode(struct inode *inode) 
	}

	list_del_init(&bdev->bd_list);

	spin_unlock(&bdev_lock);

	if (bdev->bd_bdi != &noop_backing_dev_info)

	if (bdev->bd_bdi != &noop_backing_dev_info) {

		bdi_put(bdev->bd_bdi);

		bdev->bd_bdi = &noop_backing_dev_info;

	}

}



static const struct super_operations bdev_sops = {
@@ -657,7 +660,6 @@ struct block_device *bdget(dev_t dev) 
		bdev->bd_contains = NULL;

		bdev->bd_super = NULL;

		bdev->bd_inode = inode;

		bdev->bd_bdi = &noop_backing_dev_info;

		bdev->bd_block_size = (1 << inode->i_blkbits);

		bdev->bd_part_count = 0;

		bdev->bd_invalidated = 0;