Commit f61816d0 authored by Kent Overstreet's avatar Kent Overstreet Committed by Kent Overstreet

bcachefs: Fix a use after free

In move_read_endio, we were checking if the next pending write has its
read completed - but this can turn after a use after free (and we were
accessing the list without a lock), so instead just better to just
unconditionally do the wakeup.
Signed-off-by: default avatarKent Overstreet <kent.overstreet@gmail.com>
parent 12bf93a4
......@@ -480,9 +480,7 @@ static void move_read_endio(struct bio *bio)
atomic_sub(io->read_sectors, &ctxt->read_sectors);
io->read_completed = true;
if (next_pending_write(ctxt))
wake_up(&ctxt->wait);
wake_up(&ctxt->wait);
closure_put(&ctxt->cl);
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment