summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2013-08-12 09:53:28 -0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-08-20 08:43:05 -0700
commit94aa327e13898c4c495a27303ce96cc52280fb25 (patch)
tree1cc52d120337ac6f45a5c23de38ab7704fd19e8f
parent9234930d6e89a7671042e6e35e318480d6b82e5f (diff)
downloadlinux-3.10-94aa327e13898c4c495a27303ce96cc52280fb25.tar.gz
linux-3.10-94aa327e13898c4c495a27303ce96cc52280fb25.tar.bz2
linux-3.10-94aa327e13898c4c495a27303ce96cc52280fb25.zip
jbd2: Fix use after free after error in jbd2_journal_dirty_metadata()
commit 91aa11fae1cf8c2fd67be0609692ea9741cdcc43 upstream. When jbd2_journal_dirty_metadata() returns error, __ext4_handle_dirty_metadata() stops the handle. However callers of this function do not count with that fact and still happily used now freed handle. This use after free can result in various issues but very likely we oops soon. The motivation of adding __ext4_journal_stop() into __ext4_handle_dirty_metadata() in commit 9ea7a0df seems to be only to improve error reporting. So replace __ext4_journal_stop() with ext4_journal_abort_handle() which was there before that commit and add WARN_ON_ONCE() to dump stack to provide useful information. Reported-by: Sage Weil <sage@inktank.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--fs/ext4/ext4_jbd2.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index 451eb404533..1c88061da52 100644
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -219,10 +219,10 @@ int __ext4_handle_dirty_metadata(const char *where, unsigned int line,
set_buffer_prio(bh);
if (ext4_handle_valid(handle)) {
err = jbd2_journal_dirty_metadata(handle, bh);
- if (err) {
- /* Errors can only happen if there is a bug */
- handle->h_err = err;
- __ext4_journal_stop(where, line, handle);
+ /* Errors can only happen if there is a bug */
+ if (WARN_ON_ONCE(err)) {
+ ext4_journal_abort_handle(where, line, __func__, bh,
+ handle, err);
}
} else {
if (inode)