From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 18 Feb 2014 01:33:01 +0000 (-0500)
Subject: jbd2: fix use after free in jbd2_journal_start_reserved()
X-Git-Tag: v3.13.6~147
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d3142a00e65cb3664db42d080ba1e5468fae21a8;p=thirdparty%2Fkernel%2Fstable.git

jbd2: fix use after free in jbd2_journal_start_reserved()

commit 92e3b40537707001d17bbad800d150ab04e53bf4 upstream.

If start_this_handle() fails then it leads to a use after free of
"handle".

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 8360674c85bcb..60bb365f54a52 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
 	 * similarly constrained call sites
 	 */
 	ret = start_this_handle(journal, handle, GFP_NOFS);
-	if (ret < 0)
+	if (ret < 0) {
 		jbd2_journal_free_reserved(handle);
+		return ret;
+	}
 	handle->h_type = type;
 	handle->h_line_no = line_no;
-	return ret;
+	return 0;
 }
 EXPORT_SYMBOL(jbd2_journal_start_reserved);