f2fs: fix a problem of using memory after free

Yunlei He · pundiramit · commit b1e97c8a7e67 · 2017-10-15T23:28:32.000+05:30
commit 7855eba4d6102f811b6dd142d6c749f53b591fa3 upstream. This patch fix a problem of using memory after free in function __try_merge_extent_node. Fixes: 0f825ee ("f2fs: add new interfaces for extent tree") Cc: <stable@vger.kernel.org> Signed-off-by: Yunlei He <heyunlei@huawei.com> Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
@@ -352,11 +352,12 @@ static struct extent_node *__try_merge_extent_node(struct inode *inode,
 	}
 
 	if (next_ex && __is_front_mergeable(ei, &next_ex->ei)) {
-		if (en)
-			__release_extent_node(sbi, et, prev_ex);
 		next_ex->ei.fofs = ei->fofs;
 		next_ex->ei.blk = ei->blk;
 		next_ex->ei.len += ei->len;
+		if (en)
+			__release_extent_node(sbi, et, prev_ex);
+
 		en = next_ex;
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -352,11 +352,12 @@ static struct extent_node __try_merge_extent_node(struct inode inode,`
`352`	`352`	`}`
`353`	`353`
`354`	`354`	`if (next_ex && __is_front_mergeable(ei, &next_ex->ei)) {`
`355`		`- if (en)`
`356`		`- __release_extent_node(sbi, et, prev_ex);`
`357`	`355`	`next_ex->ei.fofs = ei->fofs;`
`358`	`356`	`next_ex->ei.blk = ei->blk;`
`359`	`357`	`next_ex->ei.len += ei->len;`
	`358`	`+ if (en)`
	`359`	`+ __release_extent_node(sbi, et, prev_ex);`
	`360`	`+`
`360`	`361`	`en = next_ex;`
`361`	`362`	`}`
`362`	`363`