bdi: Fix use after free bug in debugfs_remove()

[sfrench/cifs-2.6.git] / mm / backing-dev.c

diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 023190c69dce71c528cccb7498e7456d41f674d3..7441bd93b732000f7405f191991b102eefc26832 100644 (file)
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -115,6 +115,7 @@ static int bdi_debug_register(struct backing_dev_info *bdi, const char *name)
                                               bdi, &bdi_debug_stats_fops);
        if (!bdi->debug_stats) {
                debugfs_remove(bdi->debug_dir);
+               bdi->debug_dir = NULL;
                return -ENOMEM;
        }
 
@@ -383,7 +384,7 @@ static void wb_shutdown(struct bdi_writeback *wb)
         * the barrier provided by test_and_clear_bit() above.
         */
        smp_wmb();
-       clear_bit(WB_shutting_down, &wb->state);
+       clear_and_wake_up_bit(WB_shutting_down, &wb->state);
 }
 
 static void wb_exit(struct bdi_writeback *wb)