block: Initialize bd_bdi on inode initialization
authorJan Kara <jack@suse.cz>
Thu, 2 Mar 2017 15:50:13 +0000 (16:50 +0100)
committerJens Axboe <axboe@fb.com>
Thu, 2 Mar 2017 15:56:59 +0000 (08:56 -0700)
commita5a79d00017c9eee68a9bcb40d5dfd6f45f17461
treedc1803bee107865dbea5c4434bad158a15a66ced
parente02898b423802b1f3a3aaa7f16e896da069ba8f7
block: Initialize bd_bdi on inode initialization

So far we initialized bd_bdi only in bdget(). That is fine for normal
bdev inodes however for the special case of the root inode of
blockdev_superblock that function is never called and thus bd_bdi is
left uninitialized. As a result bdev_evict_inode() may oops doing
bdi_put(root->bd_bdi) on that inode as can be seen when doing:

mount -t bdev none /mnt

Fix the problem by initializing bd_bdi when first allocating the inode
and then reinitializing bd_bdi in bdev_evict_inode().

Thanks to syzkaller team for finding the problem.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Fixes: b1d2dc5659b4 ("block: Make blk_get_backing_dev_info() safe without open bdev")
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jens Axboe <axboe@fb.com>
fs/block_dev.c