diff options
| author | Ritesh Harjani <riteshh@linux.ibm.com> | 2022-02-10 18:37:11 +0300 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2022-02-26 05:28:10 +0300 |
| commit | cc16eecae687912238ee6efbff71ad31e2bc414e (patch) | |
| tree | d987da63f7476ca23d89f8dd9f4656d0a227e3d3 /include/linux/jbd2.h | |
| parent | e3952fcce1aad934f1322843b564ff86256444b2 (diff) | |
| download | linux-cc16eecae687912238ee6efbff71ad31e2bc414e.tar.xz | |
jbd2: fix use-after-free of transaction_t race
jbd2_journal_wait_updates() is called with j_state_lock held. But if
there is a commit in progress, then this transaction might get committed
and freed via jbd2_journal_commit_transaction() ->
jbd2_journal_free_transaction(), when we release j_state_lock.
So check for journal->j_running_transaction everytime we release and
acquire j_state_lock to avoid use-after-free issue.
Link: https://lore.kernel.org/r/948c2fed518ae739db6a8f7f83f1d58b504f87d0.1644497105.git.ritesh.list@gmail.com
Fixes: 4f98186848707f53 ("jbd2: refactor wait logic for transaction updates into a common function")
Cc: stable@kernel.org
Reported-and-tested-by: syzbot+afa2ca5171d93e44b348@syzkaller.appspotmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Diffstat (limited to 'include/linux/jbd2.h')
0 files changed, 0 insertions, 0 deletions