In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: fix leaked inode reference on writeback abort at umount<\/p>\n
ceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it
\nbumps i_wrbuffer_ref (taking an ihold() on the 0->1 transition) and
\nattaches the snap_context to folio->private. That claim is released only
\nby ceph_put_wrbuffer_cap_refs(), which for a submitted write runs from
\nwritepages_finish().<\/p>\n
In ceph_submit_write(), if ceph_inc_osd_stopping_blocker() fails — which
\nhappens during umount — the request is aborted before submission: the
\nalready-collected folios are only redirtied and unlocked, so
\nwritepages_finish() never runs and the claim is leaked.
\nredirty_page_for_writepage() -> folio_redirty_for_writepage() ->
\nfilemap_dirty_folio() sets PG_dirty directly and does not go through
\n->dirty_folio, so ceph_dirty_folio() is not re-entered to rebalance it.
\nBecause every subsequent writeback also fails the osd_stopping_blocker,
\ni_wrbuffer_ref never returns to 0, the ihold() is never dropped, and the
\ninode cannot be evicted:<\/p>\n
VFS: Busy inodes after unmount of ceph
\n kernel BUG at fs\/super.c:650!<\/p>\n
Release the orphaned claim in the abort path before redirtying, via
\nceph_undo_wrbuffer_claim(): detach the snap_context, drop the wrbuffer
\nreference (letting i_wrbuffer_ref reach 0 and iput() the inode), and drop
\nthe snap_context reference — i.e. do what writepages_finish() would have
\ndone for these never-submitted folios.<\/p>\n
Only the locked_pages entries are undone; folios still in the fbatch were
\nnever dirty-cleared by this call (folio_clear_dirty_for_io() is the
\nownership-transfer point, and a successful move NULLs the fbatch slot), so
\nthey hold no claim this call owns.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: fix leaked inode reference on writeback abort at umount<\/p>\n
ceph_dirty_folio() takes a wrbuffer claim on each newly dirtied foli<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21568","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21568","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21568"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21568"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21568"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}