lkml.org 
[lkml]   [2018]   [Apr]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 02/61] ext4: set h_journal if there is a failure starting a reserved handle
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Theodore Ts'o <tytso@mit.edu>

    commit b2569260d55228b617bd82aba6d0db2faeeb4116 upstream.

    If ext4 tries to start a reserved handle via
    jbd2_journal_start_reserved(), and the journal has been aborted, this
    can result in a NULL pointer dereference. This is because the fields
    h_journal and h_transaction in the handle structure share the same
    memory, via a union, so jbd2_journal_start_reserved() will clear
    h_journal before calling start_this_handle(). If this function fails
    due to an aborted handle, h_journal will still be NULL, and the call
    to jbd2_journal_free_reserved() will pass a NULL journal to
    sub_reserve_credits().

    This can be reproduced by running "kvm-xfstests -c dioread_nolock
    generic/475".

    Cc: stable@kernel.org # 3.11
    Fixes: 8f7d89f36829b ("jbd2: transaction reservation support")
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Reviewed-by: Andreas Dilger <adilger@dilger.ca>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/jbd2/transaction.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/fs/jbd2/transaction.c
    +++ b/fs/jbd2/transaction.c
    @@ -528,6 +528,7 @@ int jbd2_journal_start_reserved(handle_t
    */
    ret = start_this_handle(journal, handle, GFP_NOFS);
    if (ret < 0) {
    + handle->h_journal = journal;
    jbd2_journal_free_reserved(handle);
    return ret;
    }

    \
     
     \ /
      Last update: 2018-04-30 21:31    [W:4.132 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site