Commit 92e3b405 authored by Dan Carpenter's avatar Dan Carpenter Committed by Theodore Ts'o
Browse files

jbd2: fix use after free in jbd2_journal_start_reserved() 



If start_this_handle() fails then it leads to a use after free of
"handle".

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org
parent 19ea8060

fs/jbd2/transaction.c

+4 −2
Original line number Diff line number Diff line
@@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type, 
	 * similarly constrained call sites

	 */

	ret = start_this_handle(journal, handle, GFP_NOFS);

	if (ret < 0)

	if (ret < 0) {

		jbd2_journal_free_reserved(handle);

		return ret;

	}

	handle->h_type = type;

	handle->h_line_no = line_no;

	return ret;

	return 0;

}

EXPORT_SYMBOL(jbd2_journal_start_reserved);