diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-02-17 20:33:01 -0500 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2014-02-17 20:33:01 -0500 |
| commit | 92e3b40537707001d17bbad800d150ab04e53bf4 (patch) | |
| tree | 8005d10187a240409c0ce365f23f074a468a2a4d /fs/jbd2 | |
| parent | 19ea80603715d473600cd993b9987bc97d042e02 (diff) | |
| download | lwn-92e3b40537707001d17bbad800d150ab04e53bf4.tar.gz lwn-92e3b40537707001d17bbad800d150ab04e53bf4.zip | |
jbd2: fix use after free in jbd2_journal_start_reserved()
If start_this_handle() fails then it leads to a use after free of
"handle".
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org
Diffstat (limited to 'fs/jbd2')
| -rw-r--r-- | fs/jbd2/transaction.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index 8360674c85bc..60bb365f54a5 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type, * similarly constrained call sites */ ret = start_this_handle(journal, handle, GFP_NOFS); - if (ret < 0) + if (ret < 0) { jbd2_journal_free_reserved(handle); + return ret; + } handle->h_type = type; handle->h_line_no = line_no; - return ret; + return 0; } EXPORT_SYMBOL(jbd2_journal_start_reserved); |