fix-use-after-free-in-jbd2_journal_start_reserved

   1 jbd2: fix use after free in jbd2_journal_start_reserved()
   2
   3 From: Dan Carpenter <dan.carpenter@oracle.com>
   4
   5 If start_this_handle() fails then it leads to a use after free of
   6 "handle".
   7
   8 Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
   9 Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
  10 Cc: stable@vger.kernel.org
  11
  12 diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
  13 index 8360674c85bc..60bb365f54a5 100644
  14 --- a/fs/jbd2/transaction.c
  15 +++ b/fs/jbd2/transaction.c
  16 @@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
  17          * similarly constrained call sites
  18          */
  19         ret = start_this_handle(journal, handle, GFP_NOFS);
  20 -       if (ret < 0)
  21 +       if (ret < 0) {
  22                 jbd2_journal_free_reserved(handle);
  23 +               return ret;
  24 +       }
  25         handle->h_type = type;
  26         handle->h_line_no = line_no;
  27 -       return ret;
  28 +       return 0;
  29  }
  30  EXPORT_SYMBOL(jbd2_journal_start_reserved);
  31