Jan Kara cf08282805 jbd2: fix use after free in jbd2_log_do_checkpoint() ... commit ccd3c4373e upstream. The code cleaning transaction's lists of checkpoint buffers has a bug where it increases bh refcount only after releasing journal->j_list_lock. Thus the following race is possible: CPU0 CPU1 jbd2_log_do_checkpoint() jbd2_journal_try_to_free_buffers() __journal_try_to_free_buffer(bh) ... while (transaction->t_checkpoint_io_list) ... if (buffer_locked(bh)) { <-- IO completes now, buffer gets unlocked --> spin_unlock(&journal->j_list_lock); spin_lock(&journal->j_list_lock); __jbd2_journal_remove_checkpoint(jh); spin_unlock(&journal->j_list_lock); try_to_free_buffers(page); get_bh(bh) <-- accesses freed bh Fix the problem by grabbing bh reference before unlocking journal->j_list_lock. Fixes: dc6e8d669c ("jbd2: don't call get_bh() before calling __jbd2_journal_remove_checkpoint()") Fixes: be1158cc61 ("jbd2: fold __process_buffer() into jbd2_log_do_checkpoint()") Reported-by: syzbot+7f4a27091759e2fe7453@syzkaller.appspotmail.com CC: stable@vger.kernel.org Reviewed-by: Lukas Czerner <lczerner@redhat.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-11-13 11:15:05 -08:00
..
checkpoint.c	jbd2: fix use after free in jbd2_log_do_checkpoint()	2018-11-13 11:15:05 -08:00
commit.c	jbd2: don't clear and reset errors after waiting on writeback	2017-07-06 07:02:22 -04:00
journal.c	ext4: pass -ESHUTDOWN code to jbd2 layer	2018-04-24 09:36:30 +02:00
Kconfig	jbd2: remove debug dependency on debug_fs and update Kconfig help text	2013-06-12 23:07:51 -04:00
Makefile
recovery.c	fs: have ll_rw_block users pass in op and flags separately	2016-06-07 13:41:38 -06:00
revoke.c	jbd2: don't leak memory if setting up journal fails	2017-03-15 15:08:48 -04:00
transaction.c	jbd2: don't mark block as modified if the handle is out of credits	2018-07-11 16:29:16 +02:00