[patch 5/5] fs: fix bdi writeback use after free 2

[npiggin@suse.de]

[-- Attachment #1: fs-bdiwb-rcu-fix-3.patch --]
[-- Type: text/plain, Size: 1165 bytes --]

work can be gone after wb_clear_pending, so load the sb from it first.

Signed-off-by: Nick Piggin <npiggin@suse.de>
---
 fs/fs-writeback.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Index: linux-2.6/fs/fs-writeback.c
===================================================================
--- linux-2.6.orig/fs/fs-writeback.c
+++ linux-2.6/fs/fs-writeback.c
@@ -783,6 +783,7 @@ long wb_do_writeback(struct bdi_writebac
 
 	while ((work = get_next_work_item(bdi, wb)) != NULL) {
 		enum writeback_sync_modes sync_mode;
+		struct super_block *sb;
 
 		nr_pages = work->nr_pages;
 
@@ -794,6 +795,8 @@ long wb_do_writeback(struct bdi_writebac
 		else
 			sync_mode = work->sync_mode;
 
+		sb = work->sb;
+
 		/*
 		 * If this isn't a data integrity operation, just notify
 		 * that we have seen this work and we are now starting it.
@@ -801,7 +804,7 @@ long wb_do_writeback(struct bdi_writebac
 		if (sync_mode == WB_SYNC_NONE)
 			wb_clear_pending(wb, work);
 
-		wrote += wb_writeback(wb, nr_pages, work->sb, sync_mode, 0);
+		wrote += wb_writeback(wb, nr_pages, sb, sync_mode, 0);
 
 		/*
 		 * This is a data integrity writeback, so only do the