Permalink
Browse files

jbd2: fix use after free in jbd2_journal_start_reserved()

If start_this_handle() fails then it leads to a use after free of
"handle".

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org
  • Loading branch information...
Dan Carpenter authored and tytso committed Feb 18, 2014
1 parent 19ea806 commit 92e3b40537707001d17bbad800d150ab04e53bf4
Showing with 4 additions and 2 deletions.
  1. +4 −2 fs/jbd2/transaction.c
View
@@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
* similarly constrained call sites
*/
ret = start_this_handle(journal, handle, GFP_NOFS);
- if (ret < 0)
+ if (ret < 0) {
jbd2_journal_free_reserved(handle);
+ return ret;
+ }
handle->h_type = type;
handle->h_line_no = line_no;
- return ret;
+ return 0;
}
EXPORT_SYMBOL(jbd2_journal_start_reserved);

0 comments on commit 92e3b40

Please sign in to comment.