jbd2: Fix use after free after error in jbd2_journal_dirty_metadata()
authorJan Kara <jack@suse.cz>
Mon, 12 Aug 2013 13:53:28 +0000 (09:53 -0400)
committerTheodore Ts'o <tytso@mit.edu>
Mon, 12 Aug 2013 13:53:28 +0000 (09:53 -0400)
commit095c4fa97fc80627727f55d4637047bfe87caa12
tree588ae9b5c43813460c65035becef3ee4e81b93f2
parent543fe4fa29a699ca84ef0dfa2b6ac1d676c2ed3b
jbd2: Fix use after free after error in jbd2_journal_dirty_metadata()

When jbd2_journal_dirty_metadata() returns error,
__ext4_handle_dirty_metadata() stops the handle. However callers of this
function do not count with that fact and still happily used now freed
handle. This use after free can result in various issues but very likely
we oops soon.

The motivation of adding __ext4_journal_stop() into
__ext4_handle_dirty_metadata() in commit faf8858f seems to be only to
improve error reporting. So replace __ext4_journal_stop() with
ext4_journal_abort_handle() which was there before that commit and add
WARN_ON_ONCE() to dump stack to provide useful information.

Reported-by: Sage Weil <sage@inktank.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org # 3.2+
fs/ext4/ext4_jbd2.c