redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

iomap: Fix use-after-free error in page_done callback 

In iomap_write_end, we're not holding a page reference anymore when
calling the page_done callback, but the callback needs that reference to
access the page.  To fix that, move the put_page call in
__generic_write_end into the callers of __generic_write_end.  Then, in
iomap_write_end, put the page after calling the page_done callback.

Reported-by: Jan Kara <jack@suse.cz>
Fixes: 63899c6f88 ("iomap: add a page_done callback")
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
hifive-unleashed-5.2
Andreas Gruenbacher 2019-04-30 08:45:34 -07:00 committed by Darrick J. Wong
parent 26ddb1f4fd
commit 7a77dad7e3
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/buffer.c
View File

@ -2104,7 +2104,6 @@ void __generic_write_end(struct inode *inode, loff_t pos, unsigned copied,
}
unlock_page(page);
put_page(page);
if (old_size < pos)
pagecache_isize_extended(inode, old_size, pos);
@ -2160,6 +2159,7 @@ int generic_write_end(struct file *file, struct address_space *mapping,
{
copied = block_write_end(file, mapping, pos, len, copied, page, fsdata);
__generic_write_end(mapping->host, pos, copied, page);
put_page(page);
return copied;
}
EXPORT_SYMBOL(generic_write_end);

1
fs/iomap.c
View File

@ -772,6 +772,7 @@ iomap_write_end(struct inode *inode, loff_t pos, unsigned len,
__generic_write_end(inode, pos, ret, page);
if (iomap->page_done)
iomap->page_done(inode, pos, copied, page, iomap);
put_page(page);
if (ret < len)
iomap_write_failed(inode, pos, len);