Commit 71626fd3 authored by Andreas Gruenbacher's avatar Andreas Gruenbacher Committed by Xie XiuQi
Browse files

iomap: Fix use-after-free error in page_done callback



mainline inclusion
from mainline-5.2-rc1
commit 7a77dad7
category: bugfix
bugzilla: 14547
CVE: NA

---------------------------

In iomap_write_end, we're not holding a page reference anymore when
calling the page_done callback, but the callback needs that reference to
access the page.  To fix that, move the put_page call in
__generic_write_end into the callers of __generic_write_end.  Then, in
iomap_write_end, put the page after calling the page_done callback.

Reported-by: default avatarJan Kara <jack@suse.cz>
Fixes: 63899c6f ("iomap: add a page_done callback")
Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: default avatarzhengbin <zhengbin13@huawei.com>
Reviewed-by: default avatarzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parent 60553960
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment