Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 955256f2 authored by Josef Bacik's avatar Josef Bacik
Browse files

Btrfs: fix use after free in O_DIRECT 



This fixes a bug where we use dip after we have freed it.  Instead just use the
file_offset that was passed to the function.  Thanks,

Signed-off-by: default avatarJosef Bacik <josef@redhat.com>
parent 5a92bc88

fs/btrfs/inode.c

+1 −2
Original line number Diff line number Diff line
@@ -5934,8 +5934,7 @@ static void btrfs_submit_direct(int rw, struct bio *bio, struct inode *inode, 
	 */

	if (write) {

		struct btrfs_ordered_extent *ordered;

		ordered = btrfs_lookup_ordered_extent(inode,

						      dip->logical_offset);

		ordered = btrfs_lookup_ordered_extent(inode, file_offset);

		if (!test_bit(BTRFS_ORDERED_PREALLOC, &ordered->flags) &&

		    !test_bit(BTRFS_ORDERED_NOCOW, &ordered->flags))

			btrfs_free_reserved_extent(root, ordered->start,