Re: [patch 5/5] fs: fix bdi writeback use after free 2

Jens Axboe
2009-09-15T19:29:29Z

On Wed, Sep 16 2009, npiggin@suse.de wrote:
> work can be gone after wb_clear_pending, so load the sb from it first.

This one is already moot, I fixed that in an earlier patch.

>
> Signed-off-by: Nick Piggin <npiggin@suse.de>
> ---
> fs/fs-writeback.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> Index: linux-2.6/fs/fs-writeback.c
> ===================================================================
> --- linux-2.6.orig/fs/fs-writeback.c
> +++ linux-2.6/fs/fs-writeback.c
> @@ -783,6 +783,7 @@ long wb_do_writeback(struct bdi_writebac
>
> while ((work = get_next_work_item(bdi, wb)) != NULL) {
> enum writeback_sync_modes sync_mode;
> + struct super_block *sb;
>
> nr_pages = work->nr_pages;
>
> @@ -794,6 +795,8 @@ long wb_do_writeback(struct bdi_writebac
> else
> sync_mode = work->sync_mode;
>
> + sb = work->sb;
> +
> /*
> * If this isn't a data integrity operation, just notify
> * that we have seen this work and we are now starting it.
> @@ -801,7 +804,7 @@ long wb_do_writeback(struct bdi_writebac
> if (sync_mode == WB_SYNC_NONE)
> wb_clear_pending(wb, work);
>
> - wrote += wb_writeback(wb, nr_pages, work->sb, sync_mode, 0);
> + wrote += wb_writeback(wb, nr_pages, sb, sync_mode, 0);
>
> /*
> * This is a data integrity writeback, so only do the
>
>

--
Jens Axboe