Btrfs: fix use after free in O_DIRECT

This fixes a bug where we use dip after we have freed it. Instead just use the file_offset that was passed to the function. Thanks, Signed-off-by: Josef Bacik <[email protected]>
josf · Dec 9, 2010 · 955256f · 955256f
1 parent 5a92bc8
commit 955256f
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
@@ -5934,8 +5934,7 @@ static void btrfs_submit_direct(int rw, struct bio *bio, struct inode *inode,
 	 */
 	if (write) {
 		struct btrfs_ordered_extent *ordered;
-		ordered = btrfs_lookup_ordered_extent(inode,
-						      dip->logical_offset);
+		ordered = btrfs_lookup_ordered_extent(inode, file_offset);
 		if (!test_bit(BTRFS_ORDERED_PREALLOC, &ordered->flags) &&
 		    !test_bit(BTRFS_ORDERED_NOCOW, &ordered->flags))
 			btrfs_free_reserved_extent(root, ordered->start,