* [patch] jbd2: use after free in jbd2_journal_start_reserved()
@ 2014-02-13 11:19 Dan Carpenter
2014-02-18 1:27 ` Theodore Ts'o
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2014-02-13 11:19 UTC (permalink / raw)
To: Theodore Ts'o; +Cc: linux-ext4, kernel-janitors
If start_this_handle() fails then it leads to a use after free of
"handle".
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 8360674c85bc..60bb365f54a5 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
* similarly constrained call sites
*/
ret = start_this_handle(journal, handle, GFP_NOFS);
- if (ret < 0)
+ if (ret < 0) {
jbd2_journal_free_reserved(handle);
+ return ret;
+ }
handle->h_type = type;
handle->h_line_no = line_no;
- return ret;
+ return 0;
}
EXPORT_SYMBOL(jbd2_journal_start_reserved);
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-02-18 1:27 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-02-13 11:19 [patch] jbd2: use after free in jbd2_journal_start_reserved() Dan Carpenter
2014-02-18 1:27 ` Theodore Ts'o
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).