NFS: Fix use after free in write error path

Fred Isaman · trondmypd · commit 1f84ccdf37d0 · 2017-04-20T13:51:52.000-04:00
Signed-off-by: Fred Isaman <fred.isaman@gmail.com> Fixes: 0bcbf03 ("nfs: handle request add failure properly") Cc: stable@vger.kernel.org # v4.5+ Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
@@ -561,9 +561,9 @@ static void nfs_write_error_remove_page(struct nfs_page *req)
 {
 	nfs_unlock_request(req);
 	nfs_end_page_writeback(req);
-	nfs_release_request(req);
 	generic_error_remove_page(page_file_mapping(req->wb_page),
 				  req->wb_page);
+	nfs_release_request(req);
 }
 
 /*

Original file line number	Diff line number	Diff line change
`@@ -561,9 +561,9 @@ static void nfs_write_error_remove_page(struct nfs_page *req)`
`561`	`561`	`{`
`562`	`562`	`nfs_unlock_request(req);`
`563`	`563`	`nfs_end_page_writeback(req);`
`564`		`- nfs_release_request(req);`
`565`	`564`	`generic_error_remove_page(page_file_mapping(req->wb_page),`
`566`	`565`	`req->wb_page);`
	`566`	`+ nfs_release_request(req);`
`567`	`567`	`}`
`568`	`568`
`569`	`569`	`/*`