diff options
| author | Jan Kara | 2009-02-10 17:15:34 +0100 |
|---|---|---|
| committer | Theodore Tso | 2009-02-10 17:15:34 +0100 |
| commit | 7f5aa215088b817add9c71914b83650bdd49f8a9 (patch) | |
| tree | 9b811d1f0b41a2738fc68654ae605bf5d8cf2a72 /fs/ext4/inode.c | |
| parent | Revert "ext4: wait on all pending commits in ext4_sync_fs()" (diff) | |
| download | kernel-qcow2-linux-7f5aa215088b817add9c71914b83650bdd49f8a9.tar.gz kernel-qcow2-linux-7f5aa215088b817add9c71914b83650bdd49f8a9.tar.xz kernel-qcow2-linux-7f5aa215088b817add9c71914b83650bdd49f8a9.zip | |
jbd2: Avoid possible NULL dereference in jbd2_journal_begin_ordered_truncate()
If we race with commit code setting i_transaction to NULL, we could
possibly dereference it. Proper locking requires the journal pointer
(to access journal->j_list_lock), which we don't have. So we have to
change the prototype of the function so that filesystem passes us the
journal pointer. Also add a more detailed comment about why the
function jbd2_journal_begin_ordered_truncate() does what it does and
how it should be used.
Thanks to Dan Carpenter <error27@gmail.com> for pointing to the
suspitious code.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Acked-by: Joel Becker <joel.becker@oracle.com>
CC: linux-ext4@vger.kernel.org
CC: ocfs2-devel@oss.oracle.com
CC: mfasheh@suse.de
CC: Dan Carpenter <error27@gmail.com>
Diffstat (limited to 'fs/ext4/inode.c')
| -rw-r--r-- | fs/ext4/inode.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 03ba20be1329..658c4a7f2578 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -47,8 +47,10 @@ static inline int ext4_begin_ordered_truncate(struct inode *inode, loff_t new_size) { - return jbd2_journal_begin_ordered_truncate(&EXT4_I(inode)->jinode, - new_size); + return jbd2_journal_begin_ordered_truncate( + EXT4_SB(inode->i_sb)->s_journal, + &EXT4_I(inode)->jinode, + new_size); } static void ext4_invalidatepage(struct page *page, unsigned long offset); |