From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 29 Jan 2019 10:57:25 +0000 (+0100)
Subject: 4.4-stable patches
X-Git-Tag: v4.9.154~9
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=52bd0d6815b78974bb10e0509a2e2bf6ed24bf4d;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	f2fs-read-page-index-before-freeing.patch
---

diff --git a/queue-4.4/f2fs-read-page-index-before-freeing.patch b/queue-4.4/f2fs-read-page-index-before-freeing.patch
new file mode 100644
index 00000000000..b95b6094d06
--- /dev/null
+++ b/queue-4.4/f2fs-read-page-index-before-freeing.patch
@@ -0,0 +1,47 @@
+From 0ea295dd853e0879a9a30ab61f923c26be35b902 Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Thu, 22 Nov 2018 18:58:46 +0800
+Subject: f2fs: read page index before freeing
+
+From: Pan Bian <bianpan2016@163.com>
+
+commit 0ea295dd853e0879a9a30ab61f923c26be35b902 upstream.
+
+The function truncate_node frees the page with f2fs_put_page. However,
+the page index is read after that. So, the patch reads the index before
+freeing the page.
+
+Fixes: bf39c00a9a7f ("f2fs: drop obsolete node page when it is truncated")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/node.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -590,6 +590,7 @@ static void truncate_node(struct dnode_o
+ {
+ 	struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode);
+ 	struct node_info ni;
++	pgoff_t index;
+ 
+ 	get_node_info(sbi, dn->nid, &ni);
+ 	if (dn->inode->i_blocks == 0) {
+@@ -613,10 +614,11 @@ invalidate:
+ 	clear_node_page_dirty(dn->node_page);
+ 	set_sbi_flag(sbi, SBI_IS_DIRTY);
+ 
++	index = dn->node_page->index;
+ 	f2fs_put_page(dn->node_page, 1);
+ 
+ 	invalidate_mapping_pages(NODE_MAPPING(sbi),
+-			dn->node_page->index, dn->node_page->index);
++			index, index);
+ 
+ 	dn->node_page = NULL;
+ 	trace_f2fs_truncate_node(dn->inode, dn->nid, ni.blk_addr);
diff --git a/queue-4.4/series b/queue-4.4/series
index e08c1c690d4..cd0140792b3 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -26,3 +26,4 @@ perf-unwind-take-pgoff-into-account-when-reporting-e.patch
 irqchip-gic-v3-its-align-pci-multi-msi-allocation-on-their-size.patch
 s390-smp-fix-calling-smp_call_ipl_cpu-from-ipl-cpu.patch
 arm64-mm-remove-page_mapping-check-in-__sync_icache_dcache.patch
+f2fs-read-page-index-before-freeing.patch