• Jan Kara's avatar
    jbd: fix race in buffer processing in commit code · a61d90d7
    Jan Kara authored
    
    
    In commit code, we scan buffers attached to a transaction.  During this
    scan, we sometimes have to drop j_list_lock and then we recheck whether
    the journal buffer head didn't get freed by journal_try_to_free_buffers().
     But checking for buffer_jbd(bh) isn't enough because a new journal head
    could get attached to our buffer head.  So add a check whether the journal
    head remained the same and whether it's still at the same transaction and
    list.
    
    This is a nasty bug and can cause problems like memory corruption (use after
    free) or trigger various assertions in JBD code (observed).
    
    Signed-off-by: default avatarJan Kara <jack@suse.cz>
    Cc: <stable@kernel.org>
    Cc: <linux-ext4@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    a61d90d7