In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup_writeback_umount() and inode_switch_

 1  CPU A (umount)           |          CPU B (writeback)

 1                                 inode_switch_wbs/cleanup_offline_cgwb
 2                                  atomic_inc(&isw_nr_in_flight)
 3                                  inode_prepare_wbs_switch
 4                                   -> passes SB_ACTIVE check
 5                                   __iget(inode)
 6 generic_shutdown_super
 7  sb->s_flags &= ~SB_ACTIVE
 8  cgroup_writeback_umount(sb)
 9   smp_mb()
10   atomic_read(&isw_nr_in_flight)
11   rcu_barrier()
12    -> no pending RCU callbacks
13   flush_workqueue(isw_wq)
14    -> nothing queued, returns
15  evict_inodes(sb)
16   -> Inode skipped as isw still holds a ref.
17  sop->put_super(sb)
18   /* destroys percpu counters */
19  -> VFS: Busy inodes after unmount!
20                                  wb_queue_isw()
21                                   queue_work(isw_wq, ...)
22                                  /* later in work function */
23                                  inode_switch_wbs_work_fn
24                                   process_inode_switch_wbs
25                                    iput() -> evict
26                                     percpu_counter_dec() // UAF!
27 
28Fix this by extending the RCU read-side critical section in
29inode_switch_wbs() and cleanup_offline_cgwb() to cover from
30inode_prepare_wbs_switch() through wb_queue_isw().  Since there is
31no sleep in this window, rcu_read_lock() can be used.  Then add a
32synchronize_rcu() in cgroup_writeback_umount() before the existing
33rcu_barrier(), so that all in-flight switchers that have passed the
34SB_ACTIVE check have completed queue_work() before flush_workqueue()
35is called.
36 
37The existing rcu_barrier() is intentionally retained so this fix can
38be backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that
39still queue switches via queue_rcu_work(). It is a no-op on current
40mainline (since commit e1b849cfa6b6 ("writeback: Avoid contention on
41wb->list_lock when switching inodes")) and is removed in a follow-up
42patch.