Jan Kara ac4f52e0ff jbd2: fix use after free in jbd2_journal_dirty_metadata() ... commit ad56edad08 upstream. jbd2_journal_dirty_metadata() didn't get a reference to journal_head it was working with. This is OK in most of the cases since the journal head should be attached to a transaction but in rare occasions when we are journalling data, __ext4_journalled_writepage() can race with jbd2_journal_invalidatepage() stripping buffers from a page and thus journal head can be freed under hands of jbd2_journal_dirty_metadata(). Fix the problem by getting own journal head reference in jbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers() which can possibly have the same issue). Reported-by: Zheng Liu <gnehzuil.liu@gmail.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2013-03-28 12:12:15 -07:00
..
checkpoint.c	jbd2: remove bh_state lock from checkpointing code	2012-03-13 22:45:25 -04:00
commit.c	jbd2: use GFP_NOFS for blkdev_issue_flush	2012-04-23 21:43:41 -04:00
journal.c	jbd2: don't write superblock when if its empty	2012-10-13 05:38:39 +09:00
Kconfig	Revert "task_struct: make journal_info conditional"	2009-12-17 13:23:24 -08:00
Makefile
recovery.c	jbd2: issue cache flush after checkpointing even with internal journal	2012-03-13 22:22:54 -04:00
revoke.c	jbd2: use KMEM_CACHE instead of kmem_cache_create()	2012-02-20 17:53:03 -05:00
transaction.c	jbd2: fix use after free in jbd2_journal_dirty_metadata()	2013-03-28 12:12:15 -07:00