diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-02-17 20:33:01 -0500 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2014-03-05 17:13:41 +0100 |
| commit | b5d8f63d78812bd7b1fa399561d6b7943cf30b65 (patch) | |
| tree | a3137f714f226dc6d1b7badf1ab57c53cb0d6b35 /fs | |
| parent | 16b360d6bc1b2fd7e97d6e7512f47d92325aa465 (diff) | |
jbd2: fix use after free in jbd2_journal_start_reserved()
commit 92e3b40537707001d17bbad800d150ab04e53bf4 upstream.
If start_this_handle() fails then it leads to a use after free of
"handle".
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/jbd2/transaction.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index b0b74e58697..7272cc6977e 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type, * similarly constrained call sites */ ret = start_this_handle(journal, handle, GFP_NOFS); - if (ret < 0) + if (ret < 0) { jbd2_journal_free_reserved(handle); + return ret; + } handle->h_type = type; handle->h_line_no = line_no; - return ret; + return 0; } EXPORT_SYMBOL(jbd2_journal_start_reserved); |