]> git.karo-electronics.de Git - karo-tx-linux.git/commit
jbd2: fix use after free in jbd2_journal_dirty_metadata()
authorJan Kara <jack@suse.cz>
Mon, 11 Mar 2013 17:24:56 +0000 (13:24 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 28 Mar 2013 19:17:58 +0000 (12:17 -0700)
commit813389da9647c5fef021362cd3d057bc1f5499db
treeb309a8166d70ba4206ce8e0f4cd43f6d0236e6e9
parentf6342feb18649fd1f00086d6f2d5ae0ed6749ea4
jbd2: fix use after free in jbd2_journal_dirty_metadata()

commit ad56edad089b56300fd13bb9eeb7d0424d978239 upstream.

jbd2_journal_dirty_metadata() didn't get a reference to journal_head it
was working with. This is OK in most of the cases since the journal head
should be attached to a transaction but in rare occasions when we are
journalling data, __ext4_journalled_writepage() can race with
jbd2_journal_invalidatepage() stripping buffers from a page and thus
journal head can be freed under hands of jbd2_journal_dirty_metadata().

Fix the problem by getting own journal head reference in
jbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers()
which can possibly have the same issue).

Reported-by: Zheng Liu <gnehzuil.liu@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/jbd2/transaction.c