summaryrefslogtreecommitdiffstats
path: root/fs/ext4/mballoc.c
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2013-03-11 13:24:56 -0400
committerTheodore Ts'o <tytso@mit.edu>2013-03-11 13:24:56 -0400
commitad56edad089b56300fd13bb9eeb7d0424d978239 (patch)
treebb350333433690e5a7ce3f2481c055c78ac5fef7 /fs/ext4/mballoc.c
parent386ad67c9ac043890121c066186883d1640348a4 (diff)
jbd2: fix use after free in jbd2_journal_dirty_metadata()
jbd2_journal_dirty_metadata() didn't get a reference to journal_head it was working with. This is OK in most of the cases since the journal head should be attached to a transaction but in rare occasions when we are journalling data, __ext4_journalled_writepage() can race with jbd2_journal_invalidatepage() stripping buffers from a page and thus journal head can be freed under hands of jbd2_journal_dirty_metadata(). Fix the problem by getting own journal head reference in jbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers() which can possibly have the same issue). Reported-by: Zheng Liu <gnehzuil.liu@gmail.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Cc: stable@vger.kernel.org
Diffstat (limited to 'fs/ext4/mballoc.c')
0 files changed, 0 insertions, 0 deletions