diff mbox

direct-io: fix use after free

Message ID 20160309035258.GA311@kmo-pixel (mailing list archive)
State New, archived
Headers show

Commit Message

Kent Overstreet March 9, 2016, 3:52 a.m. UTC
Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com>
---
 fs/direct-io.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Mike Krinkin March 9, 2016, 6:42 a.m. UTC | #1
Hi,

i've sent exactly the same fix a while ago in the linux-block,
here it is:

https://lkml.org/lkml/2016/1/30/146

On Tue, Mar 08, 2016 at 06:52:58PM -0900, Kent Overstreet wrote:
> Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com>
> ---
>  fs/direct-io.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/direct-io.c b/fs/direct-io.c
> index 1b2f7ffc8b..d6a9012d42 100644
> --- a/fs/direct-io.c
> +++ b/fs/direct-io.c
> @@ -472,8 +472,8 @@ static int dio_bio_complete(struct dio *dio, struct bio *bio)
>  		dio->io_error = -EIO;
>  
>  	if (dio->is_async && dio->rw == READ && dio->should_dirty) {
> -		bio_check_pages_dirty(bio);	/* transfers ownership */
>  		err = bio->bi_error;
> +		bio_check_pages_dirty(bio);	/* transfers ownership */
>  	} else {
>  		bio_for_each_segment_all(bvec, bio, i) {
>  			struct page *page = bvec->bv_page;
> -- 
> 2.7.0
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/fs/direct-io.c b/fs/direct-io.c
index 1b2f7ffc8b..d6a9012d42 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -472,8 +472,8 @@  static int dio_bio_complete(struct dio *dio, struct bio *bio)
 		dio->io_error = -EIO;
 
 	if (dio->is_async && dio->rw == READ && dio->should_dirty) {
-		bio_check_pages_dirty(bio);	/* transfers ownership */
 		err = bio->bi_error;
+		bio_check_pages_dirty(bio);	/* transfers ownership */
 	} else {
 		bio_for_each_segment_all(bvec, bio, i) {
 			struct page *page = bvec->bv_page;