]> git.baikalelectronics.ru Git - kernel.git/commit
iomap: fix a use after free in iomap_dio_rw
authorChristoph Hellwig <hch@lst.de>
Thu, 17 Jan 2019 16:58:58 +0000 (08:58 -0800)
committerDarrick J. Wong <darrick.wong@oracle.com>
Sun, 27 Jan 2019 16:47:42 +0000 (08:47 -0800)
commit6ac299549a15655335628f6cf9b40e73f9acb777
treef748a160adb1441d69886c568849ab0145db0f89
parentc6337c5009dc14e6e3f6172ddc085f3bb3978dab
iomap: fix a use after free in iomap_dio_rw

Introduce a local wait_for_completion variable to avoid an access to the
potentially freed dio struture after dropping the last reference count.

Also use the chance to document the completion behavior to make the
refcounting clear to the reader of the code.

Fixes: 2e142487a8 ("iomap: implement direct I/O")
Reported-by: Chandan Rajendra <chandan@linux.ibm.com>
Reported-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Tested-by: Chandan Rajendra <chandan@linux.ibm.com>
Tested-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
fs/iomap.c