From 71626fd30f3e60bbfce0f2fdcc01352d6afbd173 Mon Sep 17 00:00:00 2001 From: Andreas Gruenbacher Date: Mon, 10 Jun 2019 16:48:25 +0800 Subject: [PATCH] iomap: Fix use-after-free error in page_done callback mainline inclusion from mainline-5.2-rc1 commit 7a77dad7e3be1280456508841ccdd2a091b1906a category: bugfix bugzilla: 14547 CVE: NA --------------------------- In iomap_write_end, we're not holding a page reference anymore when calling the page_done callback, but the callback needs that reference to access the page. To fix that, move the put_page call in __generic_write_end into the callers of __generic_write_end. Then, in iomap_write_end, put the page after calling the page_done callback. Reported-by: Jan Kara Fixes: 63899c6f8851 ("iomap: add a page_done callback") Signed-off-by: Andreas Gruenbacher Reviewed-by: Jan Kara Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: zhengbin Reviewed-by: zhangyi (F) Signed-off-by: Yang Yingliang --- fs/buffer.c | 2 +- fs/iomap.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/buffer.c b/fs/buffer.c index 057e7187e416..5aa491da496b 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2104,7 +2104,6 @@ void __generic_write_end(struct inode *inode, loff_t pos, unsigned copied, } unlock_page(page); - put_page(page); if (old_size < pos) pagecache_isize_extended(inode, old_size, pos); @@ -2160,6 +2159,7 @@ int generic_write_end(struct file *file, struct address_space *mapping, { copied = block_write_end(file, mapping, pos, len, copied, page, fsdata); __generic_write_end(mapping->host, pos, copied, page); + put_page(page); return copied; } EXPORT_SYMBOL(generic_write_end); diff --git a/fs/iomap.c b/fs/iomap.c index 588df067af22..295ec937c2e2 100644 --- a/fs/iomap.c +++ b/fs/iomap.c @@ -775,6 +775,7 @@ iomap_write_end(struct inode *inode, loff_t pos, unsigned len, __generic_write_end(inode, pos, ret, page); if (iomap->page_done) iomap->page_done(inode, pos, copied, page, iomap); + put_page(page); if (ret < len) iomap_write_failed(inode, pos, len); -- GitLab