[PATCH 3/10] Reiser4: fix use after free in jrelse_tail

[Laurent Riffard]

(From Andrew Wade <[EMAIL PROTECTED]>)

"[nikita-1936] assertion failed: reiser4_no_counters_are_held()" turned
out to be a bug in the debugging code. I've applied the patch below and
haven't had a recurrence.
---
fs/reiser4/jnode.c |    4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/reiser4/jnode.c b/fs/reiser4/jnode.c
index e814712..8e4c026 100644
--- a/fs/reiser4/jnode.c
+++ b/fs/reiser4/jnode.c
@@ -999,10 +999,10 @@ void jrelse_tail(jnode * node /* jnode to release 
references to */ )
{
        assert("nikita-489", atomic_read(&node->d_count) > 0);
        atomic_dec(&node->d_count);
-       /* release reference acquired in jload_gfp() or jinit_new() */
-       jput(node);
        if (jnode_is_unformatted(node) || jnode_is_znode(node))
                LOCK_CNT_DEC(d_refs);
+       /* release reference acquired in jload_gfp() or jinit_new() */
+       jput(node);
}

/* drop reference to node data. When last reference is dropped, data are
-- 1.4.4.1.gaed4