* [patch] jbd2: use after free in jbd2_journal_start_reserved()
@ 2014-02-13 11:19 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2014-02-13 11:19 UTC (permalink / raw
To: Theodore Ts'o; +Cc: linux-ext4, kernel-janitors
If start_this_handle() fails then it leads to a use after free of
"handle".
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 8360674c85bc..60bb365f54a5 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
* similarly constrained call sites
*/
ret = start_this_handle(journal, handle, GFP_NOFS);
- if (ret < 0)
+ if (ret < 0) {
jbd2_journal_free_reserved(handle);
+ return ret;
+ }
handle->h_type = type;
handle->h_line_no = line_no;
- return ret;
+ return 0;
}
EXPORT_SYMBOL(jbd2_journal_start_reserved);
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [patch] jbd2: use after free in jbd2_journal_start_reserved()
@ 2014-02-13 11:19 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2014-02-13 11:19 UTC (permalink / raw
To: Theodore Ts'o; +Cc: linux-ext4, kernel-janitors
If start_this_handle() fails then it leads to a use after free of
"handle".
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 8360674c85bc..60bb365f54a5 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
* similarly constrained call sites
*/
ret = start_this_handle(journal, handle, GFP_NOFS);
- if (ret < 0)
+ if (ret < 0) {
jbd2_journal_free_reserved(handle);
+ return ret;
+ }
handle->h_type = type;
handle->h_line_no = line_no;
- return ret;
+ return 0;
}
EXPORT_SYMBOL(jbd2_journal_start_reserved);
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [patch] jbd2: use after free in jbd2_journal_start_reserved()
2014-02-13 11:19 ` Dan Carpenter
@ 2014-02-18 1:27 ` Theodore Ts'o
-1 siblings, 0 replies; 4+ messages in thread
From: Theodore Ts'o @ 2014-02-18 1:27 UTC (permalink / raw
To: Dan Carpenter; +Cc: linux-ext4, kernel-janitors
On Thu, Feb 13, 2014 at 02:19:53PM +0300, Dan Carpenter wrote:
> If start_this_handle() fails then it leads to a use after free of
> "handle".
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Thanks, applied.
- Ted
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [patch] jbd2: use after free in jbd2_journal_start_reserved()
@ 2014-02-18 1:27 ` Theodore Ts'o
0 siblings, 0 replies; 4+ messages in thread
From: Theodore Ts'o @ 2014-02-18 1:27 UTC (permalink / raw
To: Dan Carpenter; +Cc: linux-ext4, kernel-janitors
On Thu, Feb 13, 2014 at 02:19:53PM +0300, Dan Carpenter wrote:
> If start_this_handle() fails then it leads to a use after free of
> "handle".
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Thanks, applied.
- Ted
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-02-18 1:27 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-02-13 11:19 [patch] jbd2: use after free in jbd2_journal_start_reserved() Dan Carpenter
2014-02-13 11:19 ` Dan Carpenter
2014-02-18 1:27 ` Theodore Ts'o
2014-02-18 1:27 ` Theodore Ts'o
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.