diff options
| author |   Andreas Gruenbacher <agruenba@redhat.com> | 2019-04-30 08:45:34 -0700 |
|---|---|---|
| committer |   Darrick J. Wong <darrick.wong@oracle.com> | 2019-05-01 07:47:37 -0700 |
| commit | 7a77dad7e3be1280456508841ccdd2a091b1906a (patch) | |
| tree | 7510729009e7832f994a672e224a1d92aee8326d /include/linux/iomap.h | |
| parent | fs: Turn __generic_write_end into a void function (diff) | |
| download | linux-dev-7a77dad7e3be1280456508841ccdd2a091b1906a.tar.xz linux-dev-7a77dad7e3be1280456508841ccdd2a091b1906a.zip | |
iomap: Fix use-after-free error in page_done callback
In iomap_write_end, we're not holding a page reference anymore when
calling the page_done callback, but the callback needs that reference to
access the page. To fix that, move the put_page call in
__generic_write_end into the callers of __generic_write_end. Then, in
iomap_write_end, put the page after calling the page_done callback.
Reported-by: Jan Kara <jack@suse.cz>
Fixes: 63899c6f8851 ("iomap: add a page_done callback")
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Diffstat (limited to 'include/linux/iomap.h')
0 files changed, 0 insertions, 0 deletions