[PATCH] writeback: Fix memory corruption in writeback code

[Jan Kara]

Commit 167d6693deb3 ("fs/writeback: bail out if there is no more inodes
for IO and queued once") made the loop in wb_writeback() continue, even
if we didn't have any inodes in b_more_io list when we didn't queue any
inodes into b_io list yet. Conceptually this is fine however the loop in
this case takes the first inode from b_more_io list and waits for
writeback on it to complete. When b_more_io list is empty, this results
in accesses beyond the wb->b_more_io list head corrupting struct
wb_writeback and memory beyond it. Fix the problem by directly
restarting the loop in this case instead of going through waiting on
inode in b_more_io list.

Reported-by: syzbot+7b219b86935220db6dd8@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: 167d6693deb3 ("fs/writeback: bail out if there is no more inodes for IO and queued once")
Signed-off-by: Jan Kara <jack@xxxxxxx>
---
 fs/fs-writeback.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index f7ed4192d0f8..92a5b8283528 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -2137,7 +2137,7 @@ static long wb_writeback(struct bdi_writeback *wb,
 		 * mean the overall work is done. So we keep looping as long
 		 * as made some progress on cleaning pages or inodes.
 		 */
-		if (progress) {
+		if (progress || !queued) {
 			spin_unlock(&wb->list_lock);
 			continue;
 		}
@@ -2145,7 +2145,7 @@ static long wb_writeback(struct bdi_writeback *wb,
 		/*
 		 * No more inodes for IO, bail
 		 */
-		if (list_empty(&wb->b_more_io) && queued) {
+		if (list_empty(&wb->b_more_io)) {
 			spin_unlock(&wb->list_lock);
 			break;
 		}
-- 
2.35.3


--q5dy3frwjvcfpelv--