Commit 7a77dad7 authored by Andreas Gruenbacher's avatar Andreas Gruenbacher Committed by Darrick J. Wong
Browse files

iomap: Fix use-after-free error in page_done callback 



In iomap_write_end, we're not holding a page reference anymore when
calling the page_done callback, but the callback needs that reference to
access the page.  To fix that, move the put_page call in
__generic_write_end into the callers of __generic_write_end.  Then, in
iomap_write_end, put the page after calling the page_done callback.

Reported-by: default avatarJan Kara <jack@suse.cz>
Fixes: 63899c6f ("iomap: add a page_done callback")
Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
parent 26ddb1f4

fs/buffer.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -2104,7 +2104,6 @@ void __generic_write_end(struct inode *inode, loff_t pos, unsigned copied, 
	}

	}





	unlock_page(page);

	unlock_page(page);

	put_page(page);





	if (old_size < pos)

	if (old_size < pos)

		pagecache_isize_extended(inode, old_size, pos);

		pagecache_isize_extended(inode, old_size, pos);
@@ -2160,6 +2159,7 @@ int generic_write_end(struct file *file, struct address_space *mapping, 
{

{

	copied = block_write_end(file, mapping, pos, len, copied, page, fsdata);

	copied = block_write_end(file, mapping, pos, len, copied, page, fsdata);

	__generic_write_end(mapping->host, pos, copied, page);

	__generic_write_end(mapping->host, pos, copied, page);

	put_page(page);

	return copied;

	return copied;

}

}

EXPORT_SYMBOL(generic_write_end);

EXPORT_SYMBOL(generic_write_end);

fs/iomap.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -772,6 +772,7 @@ iomap_write_end(struct inode *inode, loff_t pos, unsigned len, 
	__generic_write_end(inode, pos, ret, page);

	__generic_write_end(inode, pos, ret, page);

	if (iomap->page_done)

	if (iomap->page_done)

		iomap->page_done(inode, pos, copied, page, iomap);

		iomap->page_done(inode, pos, copied, page, iomap);

	put_page(page);





	if (ret < len)

	if (ret < len)

		iomap_write_failed(inode, pos, len);

		iomap_write_failed(inode, pos, len);

CRA Git | Maintained and supported by SUSTech CRA and CCSE