commit c032bfcf468013643e05c8274824af10dd7cbb61
author Lachlan McIlroy <lachlan@sgi.com> Fri Jul 18 17:13:12 2008 +1000
committer Niv Sardi <xaiki@debian.org> Mon Jul 28 16:59:34 2008 +1000
tree a45a27cb8647dd5685deccf2035acada24a93f4a
parent 6a617dd22bdbf5a4c9828db98c1a8b076c9e95c8

[XFS] fix use after free with external logs or real-time devices

SGI-PV: 983806

SGI-Modid: xfs-linux-melb:xfs-kern:31666a

Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
Signed-off-by: Christoph Hellwig <hch@infradead.org>

fs/xfs/linux-2.6/xfs_super.c

diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index b400866..30ae963 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -792,12 +792,14 @@
 	struct xfs_mount	*mp)
 {
 	if (mp->m_logdev_targp && mp->m_logdev_targp != mp->m_ddev_targp) {
+		struct block_device *logdev = mp->m_logdev_targp->bt_bdev;
 		xfs_free_buftarg(mp->m_logdev_targp);
-		xfs_blkdev_put(mp->m_logdev_targp->bt_bdev);
+		xfs_blkdev_put(logdev);
 	}
 	if (mp->m_rtdev_targp) {
+		struct block_device *rtdev = mp->m_rtdev_targp->bt_bdev;
 		xfs_free_buftarg(mp->m_rtdev_targp);
-		xfs_blkdev_put(mp->m_rtdev_targp->bt_bdev);
+		xfs_blkdev_put(rtdev);
 	}
 	xfs_free_buftarg(mp->m_ddev_targp);
 }