diff options
| author | Kent Overstreet <kent.overstreet@gmail.com> | 2020-03-16 14:49:52 -0400 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@linux.dev> | 2023-10-22 17:08:36 -0400 |
| commit | 286d8ad040ddb9a496ac4a8551d72b827e604243 (patch) | |
| tree | d4313a76732b3aa72438964b933f2a7153409afc | |
| parent | 511ed5bf7626ecbba679d7a4c19d3f26685fd431 (diff) | |
bcachefs: Fix a use after free in dio write path
Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
| -rw-r--r-- | fs/bcachefs/fs-io.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/fs/bcachefs/fs-io.c b/fs/bcachefs/fs-io.c index 4a20bb11151c..726c55072b7b 100644 --- a/fs/bcachefs/fs-io.c +++ b/fs/bcachefs/fs-io.c @@ -1787,7 +1787,7 @@ static long bch2_dio_write_loop(struct dio_write *dio) struct bio_vec *bv; unsigned unaligned; u64 new_i_size; - bool sync; + bool sync = dio->sync; long ret; if (dio->loop) @@ -1830,7 +1830,7 @@ static long bch2_dio_write_loop(struct dio_write *dio) if (!dio->sync && !dio->loop && dio->iter.count) { if (bch2_dio_write_copy_iov(dio)) { - dio->sync = true; + dio->sync = sync = true; goto do_io; } } @@ -1838,7 +1838,7 @@ do_io: dio->loop = true; closure_call(&dio->op.cl, bch2_write, NULL, NULL); - if (dio->sync) + if (sync) wait_for_completion(&dio->done); else return -EIOCBQUEUED; @@ -1872,7 +1872,6 @@ err: if (dio->free_iov) kfree(dio->iter.__iov); - sync = dio->sync; bio_put(bio); /* inode->i_dio_count is our ref on inode and thus bch_fs */ |