summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTheodore Ts'o <tytso@mit.edu>2018-04-18 11:49:31 -0400
committerTheodore Ts'o <tytso@mit.edu>2018-04-18 11:49:31 -0400
commitb2569260d55228b617bd82aba6d0db2faeeb4116 (patch)
tree45069307616ca3dc612cca1425de5a1f0b9647be
parent349fa7d6e1935f49bf4161c4900711b2989180a9 (diff)
downloadlinux-stable-b2569260d55228b617bd82aba6d0db2faeeb4116.tar.gz
linux-stable-b2569260d55228b617bd82aba6d0db2faeeb4116.tar.bz2
linux-stable-b2569260d55228b617bd82aba6d0db2faeeb4116.zip
ext4: set h_journal if there is a failure starting a reserved handle
If ext4 tries to start a reserved handle via jbd2_journal_start_reserved(), and the journal has been aborted, this can result in a NULL pointer dereference. This is because the fields h_journal and h_transaction in the handle structure share the same memory, via a union, so jbd2_journal_start_reserved() will clear h_journal before calling start_this_handle(). If this function fails due to an aborted handle, h_journal will still be NULL, and the call to jbd2_journal_free_reserved() will pass a NULL journal to sub_reserve_credits(). This can be reproduced by running "kvm-xfstests -c dioread_nolock generic/475". Cc: stable@kernel.org # 3.11 Fixes: 8f7d89f36829b ("jbd2: transaction reservation support") Signed-off-by: Theodore Ts'o <tytso@mit.edu> Reviewed-by: Andreas Dilger <adilger@dilger.ca> Reviewed-by: Jan Kara <jack@suse.cz>
-rw-r--r--fs/jbd2/transaction.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index ac311037d7a5..8aa453784402 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -532,6 +532,7 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
*/
ret = start_this_handle(journal, handle, GFP_NOFS);
if (ret < 0) {
+ handle->h_journal = journal;
jbd2_journal_free_reserved(handle);
return ret;
}