[PATCH] jbd: journal_head unmapping race fix
Fix a race identified by Chris Mason <mason@suse.com> journal_unmap_buffer -> __dispose_buffers has the j_list_lock and the jbd_lock_bh_state held. journal_get_write_access calls journal_put_journal_head, which takes jbd_lock_bh_journal_head(bh) and doesn't seem to have any other locks held. Since journal_unmap_buffers trusts the buffer_jbd bit to see if we need to call __dispose_buffer, and nobody seems to test buffer_jbd after taking jbd_lock_bh_journal_head. The kernel dereferences a null jh pointer in __journal_remove_journal_head. The patch fixes this by using journal_grab_journal_head() in journal_unmap_buffer(). It ensures that we either grab and pin the journal_head if the bh has one, or we bale out if the bh doesn't have a journal_head. Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Showing
Please register or sign in to comment