linux/fs/jbd2
Jan Kara ad56edad08 jbd2: fix use after free in jbd2_journal_dirty_metadata()
jbd2_journal_dirty_metadata() didn't get a reference to journal_head it
was working with. This is OK in most of the cases since the journal head
should be attached to a transaction but in rare occasions when we are
journalling data, __ext4_journalled_writepage() can race with
jbd2_journal_invalidatepage() stripping buffers from a page and thus
journal head can be freed under hands of jbd2_journal_dirty_metadata().

Fix the problem by getting own journal head reference in
jbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers()
which can possibly have the same issue).

Reported-by: Zheng Liu <gnehzuil.liu@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org
2013-03-11 13:24:56 -04:00
..
checkpoint.c jbd2: remove bh_state lock from checkpointing code 2012-03-13 22:45:25 -04:00
commit.c jbd2: track request delay statistics 2013-02-06 22:30:23 -05:00
journal.c jbd2: use module parameters instead of debugfs for jbd_debug 2013-02-09 16:29:20 -05:00
Kconfig jbd2: Grab a reference to the crc32c driver if necessary 2012-05-27 07:50:56 -04:00
Makefile [PATCH] jbd2: rename jbd2 symbols to avoid duplication of jbd symbols 2006-10-11 11:14:15 -07:00
recovery.c jbd2: check return value of blkdev_issue_flush() 2012-08-17 09:56:17 -04:00
revoke.c jbd2: checksum revocation blocks 2012-05-27 08:08:24 -04:00
transaction.c jbd2: fix use after free in jbd2_journal_dirty_metadata() 2013-03-11 13:24:56 -04:00