[PATCH 4.19 138/170] f2fs: read page index before freeing

From: Greg Kroah-Hartman
Date: Mon Jan 07 2019 - 08:19:40 EST

4.19-stable review patch. If anyone has any objections, please let me know.


From: Pan Bian <bianpan2016@xxxxxxx>

commit 0ea295dd853e0879a9a30ab61f923c26be35b902 upstream.

The function truncate_node frees the page with f2fs_put_page. However,
the page index is read after that. So, the patch reads the index before
freeing the page.

Fixes: bf39c00a9a7f ("f2fs: drop obsolete node page when it is truncated")
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Pan Bian <bianpan2016@xxxxxxx>
Reviewed-by: Chao Yu <yuchao0@xxxxxxxxxx>
Signed-off-by: Jaegeuk Kim <jaegeuk@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

fs/f2fs/node.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -827,6 +827,7 @@ static int truncate_node(struct dnode_of
struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode);
struct node_info ni;
int err;
+ pgoff_t index;

err = f2fs_get_node_info(sbi, dn->nid, &ni);
if (err)
@@ -846,10 +847,11 @@ static int truncate_node(struct dnode_of
set_sbi_flag(sbi, SBI_IS_DIRTY);

+ index = dn->node_page->index;
f2fs_put_page(dn->node_page, 1);

- dn->node_page->index, dn->node_page->index);
+ index, index);

dn->node_page = NULL;
trace_f2fs_truncate_node(dn->inode, dn->nid, ni.blk_addr);