[Cluster-devel] [PATCH v6 2/4] iomap: Fix use-after-free error in page_done callback

[Andreas Gruenbacher]

In iomap_write_end, we're not holding a page reference anymore when
calling the page_done callback, but the callback needs that reference to
access the page.  To fix that, move the put_page call in
__generic_write_end into the callers of __generic_write_end.  Then, in
iomap_write_end, put the page after calling the page_done callback.

Reported-by: Jan Kara <j...@suse.cz>
Fixes: 63899c6f8851 ("iomap: add a page_done callback")
Signed-off-by: Andreas Gruenbacher <agrue...@redhat.com>
Reviewed-by: Jan Kara <j...@suse.cz>
---
 fs/buffer.c | 5 +++--
 fs/iomap.c  | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/buffer.c b/fs/buffer.c
index ce357602f471..6e2c95160ce3 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2104,7 +2104,6 @@ int __generic_write_end(struct inode *inode, loff_t pos, 
unsigned copied,
        }
 
        unlock_page(page);
-       put_page(page);
 
        if (old_size < pos)
                pagecache_isize_extended(inode, old_size, pos);
@@ -2160,7 +2159,9 @@ int generic_write_end(struct file *file, struct 
address_space *mapping,
                        struct page *page, void *fsdata)
 {
        copied = block_write_end(file, mapping, pos, len, copied, page, fsdata);
-       return __generic_write_end(mapping->host, pos, copied, page);
+       copied = __generic_write_end(mapping->host, pos, copied, page);
+       put_page(page);
+       return copied;
 }
 EXPORT_SYMBOL(generic_write_end);
 
diff --git a/fs/iomap.c b/fs/iomap.c
index 2344c662e6fc..b01ed5a28d2c 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -780,6 +780,7 @@ iomap_write_end(struct inode *inode, loff_t pos, unsigned 
len,
        ret = __generic_write_end(inode, pos, ret, page);
        if (iomap->page_done)
                iomap->page_done(inode, pos, copied, page, iomap);
+       put_page(page);
 
        if (ret < len)
                iomap_write_failed(inode, pos, len);
-- 
2.20.1