In the Linux kernel, the following vulnerability has been resolved: writeback: avoid use-after-free after removing device When a disk is removed, bdi_unregister gets called to stop further writeback and wait for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation dwork after this has completed, which can result in the timer attempting to access the just freed bdi_writeback. Fix this by checking if the bdi_writeback is alive, similar to when scheduling writeback work. Since this requires wb->work_lock, and wb_inode_writeback_end() may get called from interrupt, switch wb->work_lock to an irqsafe lock.
| Product | Vendor | Version |
|---|---|---|
| Linux | Linux | DP300 V500R002C00 |
| Linux | Linux | RP200 V500R002C00 |
| Linux | Linux | 3.5.0 to 3.5.2 |
| Linux | Linux | n/a |