iomap: Fix use-after-free error in page_done callback
authorAndreas Gruenbacher <agruenba@redhat.com>
Tue, 30 Apr 2019 15:45:34 +0000 (08:45 -0700)
committerDarrick J. Wong <darrick.wong@oracle.com>
Wed, 1 May 2019 14:47:37 +0000 (07:47 -0700)
commit7a77dad7e3be1280456508841ccdd2a091b1906a
tree7510729009e7832f994a672e224a1d92aee8326d
parent26ddb1f4fd884258eeb8a8d7f2d40b163f00fedd
iomap: Fix use-after-free error in page_done callback

In iomap_write_end, we're not holding a page reference anymore when
calling the page_done callback, but the callback needs that reference to
access the page.  To fix that, move the put_page call in
__generic_write_end into the callers of __generic_write_end.  Then, in
iomap_write_end, put the page after calling the page_done callback.

Reported-by: Jan Kara <jack@suse.cz>
Fixes: 63899c6f8851 ("iomap: add a page_done callback")
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
fs/buffer.c
fs/iomap.c