Jan Kara ad56edad08 jbd2: fix use after free in jbd2_journal_dirty_metadata() ... jbd2_journal_dirty_metadata() didn't get a reference to journal_head it was working with. This is OK in most of the cases since the journal head should be attached to a transaction but in rare occasions when we are journalling data, __ext4_journalled_writepage() can race with jbd2_journal_invalidatepage() stripping buffers from a page and thus journal head can be freed under hands of jbd2_journal_dirty_metadata(). Fix the problem by getting own journal head reference in jbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers() which can possibly have the same issue). Reported-by: Zheng Liu <gnehzuil.liu@gmail.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Cc: stable@vger.kernel.org		2013-03-11 13:24:56 -04:00
..
checkpoint.c	jbd2: remove bh_state lock from checkpointing code	2012-03-13 22:45:25 -04:00
commit.c	jbd2: track request delay statistics	2013-02-06 22:30:23 -05:00
journal.c	jbd2: use module parameters instead of debugfs for jbd_debug	2013-02-09 16:29:20 -05:00
Kconfig	jbd2: Grab a reference to the crc32c driver if necessary	2012-05-27 07:50:56 -04:00
Makefile
recovery.c	jbd2: check return value of blkdev_issue_flush()	2012-08-17 09:56:17 -04:00
revoke.c	jbd2: checksum revocation blocks	2012-05-27 08:08:24 -04:00
transaction.c	jbd2: fix use after free in jbd2_journal_dirty_metadata()	2013-03-11 13:24:56 -04:00