diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-02-17 20:33:01 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-03-06 22:06:09 -0800 |
| commit | d3142a00e65cb3664db42d080ba1e5468fae21a8 (patch) | |
| tree | 7756e5f55a8f17bb9d188d68a8c9070e6281d2a1 /fs | |
| parent | e0164307b2c2f95d636ad82b157eb9c3371230a1 (diff) | |
jbd2: fix use after free in jbd2_journal_start_reserved()
commit 92e3b40537707001d17bbad800d150ab04e53bf4 upstream.
If start_this_handle() fails then it leads to a use after free of
"handle".
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/jbd2/transaction.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index 8360674c85bc..60bb365f54a5 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type, * similarly constrained call sites */ ret = start_this_handle(journal, handle, GFP_NOFS); - if (ret < 0) + if (ret < 0) { jbd2_journal_free_reserved(handle); + return ret; + } handle->h_type = type; handle->h_line_no = line_no; - return ret; + return 0; } EXPORT_SYMBOL(jbd2_journal_start_reserved); |