set-h_journal-if-reserved-handle-fails-to-start

   1 ext4: set h_journal if there is a failure starting a reserved handle
   2
   3 If ext4 tries to start a reserved handle via
   4 jbd2_journal_start_reserved(), and the journal has been aborted, this
   5 can result in a NULL pointer dereference.  This is because the fields
   6 h_journal and h_transaction in the handle structure share the same
   7 memory, via a union, so jbd2_journal_start_reserved() will clear
   8 h_journal before calling start_this_handle().  If this function fails
   9 due to an aborted handle, h_journal will still be NULL, and the call
  10 to jbd2_journal_free_reserved() will pass a NULL journal to
  11 sub_reserve_credits().
  12
  13 This can be reproduced by running "kvm-xfstests -c dioread_nolock
  14 generic/475".
  15
  16 Cc: stable@kernel.org # 3.11
  17 Fixes: 8f7d89f36829b ("jbd2: transaction reservation support")
  18 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  19 Reviewed-by: Andreas Dilger <adilger@dilger.ca>
  20 Reviewed-by: Jan Kara <jack@suse.cz>
  21 ---
  22  fs/jbd2/transaction.c | 1 +
  23  1 file changed, 1 insertion(+)
  24
  25 diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
  26 index ac311037d7a5..8aa453784402 100644
  27 --- a/fs/jbd2/transaction.c
  28 +++ b/fs/jbd2/transaction.c
  29 @@ -532,6 +532,7 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
  30          */
  31         ret = start_this_handle(journal, handle, GFP_NOFS);
  32         if (ret < 0) {
  33 +               handle->h_journal = journal;
  34                 jbd2_journal_free_reserved(handle);
  35                 return ret;
  36         }