ext4: queue conversion after adding to inode's completed IO list

By queuing the io end on the unwritten workqueue before adding it
to our inode's list of completed IOs, I think we run the risk
of the work getting completed, and the IO freed, before we try
to add it to the inode's i_completed_io_list.

It should be safe to add it to the inode's list of completed
IOs, and -then- queue it for completion, I think.

Thanks to Dave Chinner for pointing out the race.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Jiaying Zhang <jiayingz@google.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

1 files changed, 3 insertions, 3 deletions

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 1e824a3ec538..670ab15e4f9a 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3850,14 +3850,14 @@ out:
         }
         wq = EXT4_SB(io_end->inode->i_sb)->dio_unwritten_wq;
 
-        /* queue the work to convert unwritten extents to written */
-        queue_work(wq, &io_end->work);
-
         /* Add the io_end to per-inode completed aio dio list*/
         ei = EXT4_I(io_end->inode);
         spin_lock_irqsave(&ei->i_completed_io_lock, flags);
         list_add_tail(&io_end->list, &ei->i_completed_io_list);
         spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
+
+        /* queue the work to convert unwritten extents to written */
+        queue_work(wq, &io_end->work);
         iocb->private = NULL;
 }