NFS: Fix use-after-free issues in nfs_pageio_add_request()
authorTrond Myklebust <trond.myklebust@hammerspace.com>
Sun, 29 Mar 2020 23:55:05 +0000 (19:55 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 17 Apr 2020 08:50:20 +0000 (10:50 +0200)
commit6b64cbd05807b92a2296fba82e871014d38cef26
tree26d1c74cfe74a639b2444cb0e3521f91b14c64db
parent98a817eda5bc9dc2faefa05e5ad45a57e10a5da8
NFS: Fix use-after-free issues in nfs_pageio_add_request()

commit dc9dc2febb17f72e9878eb540ad3996f7984239a upstream.

We need to ensure that we create the mirror requests before calling
nfs_pageio_add_request_mirror() on the request we are adding.
Otherwise, we can end up with a use-after-free if the call to
nfs_pageio_add_request_mirror() triggers I/O.

Fixes: c917cfaf9bbe ("NFS: Fix up NFS I/O subrequest creation")
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/nfs/pagelist.c