From: "Darrick J. Wong" <darrick.wong@oracle.com> To: Andreas Gruenbacher <agruenba@redhat.com> Cc: cluster-devel@redhat.com, "Christoph Hellwig" <hch@lst.de>, "Bob Peterson" <rpeterso@redhat.com>, "Jan Kara" <jack@suse.cz>, "Dave Chinner" <david@fromorbit.com>, "Ross Lagerwall" <ross.lagerwall@citrix.com>, "Mark Syms" <Mark.Syms@citrix.com>, "Edwin Török" <edvin.torok@citrix.com>, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org Subject: Re: [PATCH v7 3/5] iomap: Fix use-after-free error in page_done callback Date: Tue, 30 Apr 2019 08:23:25 -0700 [thread overview] Message-ID: <20190430152325.GD5200@magnolia> (raw) In-Reply-To: <20190429220934.10415-4-agruenba@redhat.com> On Tue, Apr 30, 2019 at 12:09:32AM +0200, Andreas Gruenbacher wrote: > In iomap_write_end, we're not holding a page reference anymore when > calling the page_done callback, but the callback needs that reference to > access the page. To fix that, move the put_page call in > __generic_write_end into the callers of __generic_write_end. Then, in > iomap_write_end, put the page after calling the page_done callback. > > Reported-by: Jan Kara <jack@suse.cz> > Fixes: 63899c6f8851 ("iomap: add a page_done callback") > Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> > Reviewed-by: Jan Kara <jack@suse.cz> > Reviewed-by: Christoph Hellwig <hch@lst.de> Looks ok, Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> --D > --- > fs/buffer.c | 2 +- > fs/iomap.c | 1 + > 2 files changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/buffer.c b/fs/buffer.c > index e0d4c6a5e2d2..0faa41fb4c88 100644 > --- a/fs/buffer.c > +++ b/fs/buffer.c > @@ -2104,7 +2104,6 @@ void __generic_write_end(struct inode *inode, loff_t pos, unsigned copied, > } > > unlock_page(page); > - put_page(page); > > if (old_size < pos) > pagecache_isize_extended(inode, old_size, pos); > @@ -2160,6 +2159,7 @@ int generic_write_end(struct file *file, struct address_space *mapping, > { > copied = block_write_end(file, mapping, pos, len, copied, page, fsdata); > __generic_write_end(mapping->host, pos, copied, page); > + put_page(page); > return copied; > } > EXPORT_SYMBOL(generic_write_end); > diff --git a/fs/iomap.c b/fs/iomap.c > index f8c9722d1a97..62e3461704ce 100644 > --- a/fs/iomap.c > +++ b/fs/iomap.c > @@ -780,6 +780,7 @@ iomap_write_end(struct inode *inode, loff_t pos, unsigned len, > __generic_write_end(inode, pos, ret, page); > if (iomap->page_done) > iomap->page_done(inode, pos, copied, page, iomap); > + put_page(page); > > if (ret < len) > iomap_write_failed(inode, pos, len); > -- > 2.20.1 >
WARNING: multiple messages have this Message-ID (diff)
From: Darrick J. Wong <darrick.wong@oracle.com> To: cluster-devel.redhat.com Subject: [Cluster-devel] [PATCH v7 3/5] iomap: Fix use-after-free error in page_done callback Date: Tue, 30 Apr 2019 08:23:25 -0700 [thread overview] Message-ID: <20190430152325.GD5200@magnolia> (raw) In-Reply-To: <20190429220934.10415-4-agruenba@redhat.com> On Tue, Apr 30, 2019 at 12:09:32AM +0200, Andreas Gruenbacher wrote: > In iomap_write_end, we're not holding a page reference anymore when > calling the page_done callback, but the callback needs that reference to > access the page. To fix that, move the put_page call in > __generic_write_end into the callers of __generic_write_end. Then, in > iomap_write_end, put the page after calling the page_done callback. > > Reported-by: Jan Kara <jack@suse.cz> > Fixes: 63899c6f8851 ("iomap: add a page_done callback") > Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> > Reviewed-by: Jan Kara <jack@suse.cz> > Reviewed-by: Christoph Hellwig <hch@lst.de> Looks ok, Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> --D > --- > fs/buffer.c | 2 +- > fs/iomap.c | 1 + > 2 files changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/buffer.c b/fs/buffer.c > index e0d4c6a5e2d2..0faa41fb4c88 100644 > --- a/fs/buffer.c > +++ b/fs/buffer.c > @@ -2104,7 +2104,6 @@ void __generic_write_end(struct inode *inode, loff_t pos, unsigned copied, > } > > unlock_page(page); > - put_page(page); > > if (old_size < pos) > pagecache_isize_extended(inode, old_size, pos); > @@ -2160,6 +2159,7 @@ int generic_write_end(struct file *file, struct address_space *mapping, > { > copied = block_write_end(file, mapping, pos, len, copied, page, fsdata); > __generic_write_end(mapping->host, pos, copied, page); > + put_page(page); > return copied; > } > EXPORT_SYMBOL(generic_write_end); > diff --git a/fs/iomap.c b/fs/iomap.c > index f8c9722d1a97..62e3461704ce 100644 > --- a/fs/iomap.c > +++ b/fs/iomap.c > @@ -780,6 +780,7 @@ iomap_write_end(struct inode *inode, loff_t pos, unsigned len, > __generic_write_end(inode, pos, ret, page); > if (iomap->page_done) > iomap->page_done(inode, pos, copied, page, iomap); > + put_page(page); > > if (ret < len) > iomap_write_failed(inode, pos, len); > -- > 2.20.1 >
next prev parent reply other threads:[~2019-04-30 15:24 UTC|newest] Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-04-29 22:09 [PATCH v7 0/5] iomap and gfs2 fixes Andreas Gruenbacher 2019-04-29 22:09 ` [Cluster-devel] " Andreas Gruenbacher 2019-04-29 22:09 ` [PATCH v7 1/5] iomap: Clean up __generic_write_end calling Andreas Gruenbacher 2019-04-29 22:09 ` [Cluster-devel] " Andreas Gruenbacher 2019-04-30 15:14 ` Darrick J. Wong 2019-04-30 15:14 ` [Cluster-devel] " Darrick J. Wong 2019-04-29 22:09 ` [PATCH v7 2/5] fs: Turn __generic_write_end into a void function Andreas Gruenbacher 2019-04-29 22:09 ` [Cluster-devel] " Andreas Gruenbacher 2019-04-30 10:29 ` Christoph Hellwig 2019-04-30 10:29 ` [Cluster-devel] " Christoph Hellwig 2019-04-30 15:17 ` Darrick J. Wong 2019-04-30 15:17 ` [Cluster-devel] " Darrick J. Wong 2019-04-29 22:09 ` [PATCH v7 3/5] iomap: Fix use-after-free error in page_done callback Andreas Gruenbacher 2019-04-29 22:09 ` [Cluster-devel] " Andreas Gruenbacher 2019-04-30 15:23 ` Darrick J. Wong [this message] 2019-04-30 15:23 ` Darrick J. Wong 2019-04-29 22:09 ` [PATCH v7 4/5] iomap: Add a page_prepare callback Andreas Gruenbacher 2019-04-29 22:09 ` [Cluster-devel] " Andreas Gruenbacher 2019-04-30 15:26 ` Darrick J. Wong 2019-04-30 15:26 ` [Cluster-devel] " Darrick J. Wong 2019-04-29 22:09 ` [PATCH v7 5/5] gfs2: Fix iomap write page reclaim deadlock Andreas Gruenbacher 2019-04-29 22:09 ` [Cluster-devel] " Andreas Gruenbacher 2019-04-30 15:32 ` Darrick J. Wong 2019-04-30 15:32 ` [Cluster-devel] " Darrick J. Wong 2019-04-30 15:39 ` Andreas Gruenbacher 2019-04-30 15:39 ` [Cluster-devel] " Andreas Gruenbacher 2019-04-30 15:47 ` Darrick J. Wong 2019-04-30 15:47 ` [Cluster-devel] " Darrick J. Wong 2019-04-30 16:15 ` Andreas Grünbacher 2019-04-30 16:15 ` [Cluster-devel] " Andreas Grünbacher 2019-04-30 2:50 ` [PATCH v7 0/5] iomap and gfs2 fixes Darrick J. Wong 2019-04-30 2:50 ` [Cluster-devel] " Darrick J. Wong 2019-04-30 21:21 ` Dave Chinner 2019-04-30 21:21 ` [Cluster-devel] " Dave Chinner 2019-05-01 15:06 ` Darrick J. Wong 2019-05-01 15:06 ` [Cluster-devel] " Darrick J. Wong
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190430152325.GD5200@magnolia \ --to=darrick.wong@oracle.com \ --cc=Mark.Syms@citrix.com \ --cc=agruenba@redhat.com \ --cc=cluster-devel@redhat.com \ --cc=david@fromorbit.com \ --cc=edvin.torok@citrix.com \ --cc=hch@lst.de \ --cc=jack@suse.cz \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=ross.lagerwall@citrix.com \ --cc=rpeterso@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.