summaryrefslogtreecommitdiff
path: root/fs/buffer.c
diff options
context:
space:
mode:
authorAndreas Gruenbacher <agruenba@redhat.com>2019-04-30 18:45:34 +0300
committerDarrick J. Wong <darrick.wong@oracle.com>2019-05-01 17:47:37 +0300
commit7a77dad7e3be1280456508841ccdd2a091b1906a (patch)
tree7510729009e7832f994a672e224a1d92aee8326d /fs/buffer.c
parent26ddb1f4fd884258eeb8a8d7f2d40b163f00fedd (diff)
downloadlinux-7a77dad7e3be1280456508841ccdd2a091b1906a.tar.xz
iomap: Fix use-after-free error in page_done callback
In iomap_write_end, we're not holding a page reference anymore when calling the page_done callback, but the callback needs that reference to access the page. To fix that, move the put_page call in __generic_write_end into the callers of __generic_write_end. Then, in iomap_write_end, put the page after calling the page_done callback. Reported-by: Jan Kara <jack@suse.cz> Fixes: 63899c6f8851 ("iomap: add a page_done callback") Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Diffstat (limited to 'fs/buffer.c')
-rw-r--r--fs/buffer.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/buffer.c b/fs/buffer.c
index e0d4c6a5e2d2..0faa41fb4c88 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2104,7 +2104,6 @@ void __generic_write_end(struct inode *inode, loff_t pos, unsigned copied,
}
unlock_page(page);
- put_page(page);
if (old_size < pos)
pagecache_isize_extended(inode, old_size, pos);
@@ -2160,6 +2159,7 @@ int generic_write_end(struct file *file, struct address_space *mapping,
{
copied = block_write_end(file, mapping, pos, len, copied, page, fsdata);
__generic_write_end(mapping->host, pos, copied, page);
+ put_page(page);
return copied;
}
EXPORT_SYMBOL(generic_write_end);