iomap: Fix use-after-free error in page_done callback
mainline inclusion from mainline-5.2-rc1 commit 7a77dad7 category: bugfix bugzilla: 14547 CVE: NA --------------------------- In iomap_write_end, we're not holding a page reference anymore when calling the page_done callback, but the callback needs that reference to access the page. To fix that, move the put_page call in __generic_write_end into the callers of __generic_write_end. Then, in iomap_write_end, put the page after calling the page_done callback. Reported-by:Jan Kara <jack@suse.cz> Fixes: 63899c6f ("iomap: add a page_done callback") Signed-off-by:
Andreas Gruenbacher <agruenba@redhat.com> Reviewed-by:
Jan Kara <jack@suse.cz> Reviewed-by:
Christoph Hellwig <hch@lst.de> Reviewed-by:
Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by:
Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by:
zhengbin <zhengbin13@huawei.com> Reviewed-by:
zhangyi (F) <yi.zhang@huawei.com> Signed-off-by:
Yang Yingliang <yangyingliang@huawei.com>
Loading
Please sign in to comment