diff options
author | Jan Kara | 2013-03-11 18:24:56 +0100 |
---|---|---|
committer | Theodore Ts'o | 2013-03-11 18:24:56 +0100 |
commit | ad56edad089b56300fd13bb9eeb7d0424d978239 (patch) | |
tree | bb350333433690e5a7ce3f2481c055c78ac5fef7 /arch/blackfin | |
parent | ext4: reserve metadata block for every delayed write (diff) | |
download | kernel-qcow2-linux-ad56edad089b56300fd13bb9eeb7d0424d978239.tar.gz kernel-qcow2-linux-ad56edad089b56300fd13bb9eeb7d0424d978239.tar.xz kernel-qcow2-linux-ad56edad089b56300fd13bb9eeb7d0424d978239.zip |
jbd2: fix use after free in jbd2_journal_dirty_metadata()
jbd2_journal_dirty_metadata() didn't get a reference to journal_head it
was working with. This is OK in most of the cases since the journal head
should be attached to a transaction but in rare occasions when we are
journalling data, __ext4_journalled_writepage() can race with
jbd2_journal_invalidatepage() stripping buffers from a page and thus
journal head can be freed under hands of jbd2_journal_dirty_metadata().
Fix the problem by getting own journal head reference in
jbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers()
which can possibly have the same issue).
Reported-by: Zheng Liu <gnehzuil.liu@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org
Diffstat (limited to 'arch/blackfin')
0 files changed, 0 insertions, 0 deletions