-
Andrew Morton authored
ext3_writepage() calls ext3_journal_stop(), which dereferences the affected inode. It does this _after_ writing the page out, which is illegal. The IO can complete, the page can be repeased from the inode and the inode can be freed up. It's a long-standing bug. It has been reported happening on preemptible kernels, where the timing window is larger. Fix that up by teaching ext3_journal_stop to locate the superblock via the journal structure, not via the inode. This means that ext3_journal_stop() does not need the inode argument at all. Also uninline the affected functions. It saves 5.5 kbytes. Also remove the setting of sb->s_dirt in ext3_journal_stop(). That was an awkward way of telling sys_sync() that the filesystem needs a commit, and with the ext3_sync_fs() that is no longer needed.
7dbfb92c