Commit 6a6d4644 authored by Scott Mayhew's avatar Scott Mayhew Committed by Anna Schumaker
Browse files

NFS: Fix potential oops in nfs_inode_remove_request() 



Once a folio's private data has been cleared, it's possible for another
process to clear the folio->mapping (e.g. via invalidate_complete_folio2
or evict_mapping_folio), so it wouldn't be safe to call
nfs_page_to_inode() after that.

Fixes: 0c493b5c ("NFS: Convert buffered writes to use folios")
Signed-off-by: default avatarScott Mayhew <smayhew@redhat.com>
Reviewed-by: default avatarBenjamin Coddington <bcodding@redhat.com>
Tested-by: default avatarBenjamin Coddington <bcodding@redhat.com>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
parent f588d72b

fs/nfs/write.c

+3 −1
Original line number Diff line number Diff line
@@ -788,6 +788,8 @@ static void nfs_inode_add_request(struct nfs_page *req) 
 */

static void nfs_inode_remove_request(struct nfs_page *req)

{

	struct nfs_inode *nfsi = NFS_I(nfs_page_to_inode(req));



	if (nfs_page_group_sync_on_bit(req, PG_REMOVE)) {

		struct folio *folio = nfs_page_to_folio(req->wb_head);

		struct address_space *mapping = folio_file_mapping(folio);
@@ -802,7 +804,7 @@ static void nfs_inode_remove_request(struct nfs_page *req) 
	}



	if (test_and_clear_bit(PG_INODE_REF, &req->wb_flags)) {

		atomic_long_dec(&NFS_I(nfs_page_to_inode(req))->nrequests);

		atomic_long_dec(&nfsi->nrequests);

		nfs_release_request(req);

	}

}