Commit c6a7b0f8 authored by Lachlan McIlroy's avatar Lachlan McIlroy Committed by Lachlan McIlroy

[XFS] Fix use after free in xfs_log_done().

The ticket allocation code got reworked in 2.6.26 and we now free tickets
whereas before we used to cache them so the use-after-free went
undetected.

SGI-PV: 985525

SGI-Modid: xfs-linux-melb:xfs-kern:31877a
Signed-off-by: default avatarLachlan McIlroy <lachlan@sgi.com>
Signed-off-by: default avatarDavid Chinner <david@fromorbit.com>
parent c94312de
...@@ -336,15 +336,12 @@ xfs_log_done(xfs_mount_t *mp, ...@@ -336,15 +336,12 @@ xfs_log_done(xfs_mount_t *mp,
} else { } else {
xlog_trace_loggrant(log, ticket, "xfs_log_done: (permanent)"); xlog_trace_loggrant(log, ticket, "xfs_log_done: (permanent)");
xlog_regrant_reserve_log_space(log, ticket); xlog_regrant_reserve_log_space(log, ticket);
}
/* If this ticket was a permanent reservation and we aren't /* If this ticket was a permanent reservation and we aren't
* trying to release it, reset the inited flags; so next time * trying to release it, reset the inited flags; so next time
* we write, a start record will be written out. * we write, a start record will be written out.
*/ */
if ((ticket->t_flags & XLOG_TIC_PERM_RESERV) &&
(flags & XFS_LOG_REL_PERM_RESERV) == 0)
ticket->t_flags |= XLOG_TIC_INITED; ticket->t_flags |= XLOG_TIC_INITED;
}
return lsn; return lsn;
} /* xfs_log_done */ } /* xfs_log_done */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment