[PATCH] JBD: use-after-free fix

The wait_event() in there can touch the memory at *transaction after
kjournald has freed it.

Rework the code to not wait until the transaction enters T_FLUSH state: just
loop back and try against after the wakeup.

diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index c19edbc4245765117cae55150200a04888e7532b..ba957c1fb3dcd1b174ec8268f0a30654967467d7 100644 (file)
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -147,10 +147,13 @@ repeat_locked:
         * lock to be released.
         */
        if (transaction->t_state == T_LOCKED) {
+               DEFINE_WAIT(wait);
+
+               prepare_to_wait(&journal->j_wait_transaction_locked,
+                                       &wait, TASK_UNINTERRUPTIBLE);
                spin_unlock(&journal->j_state_lock);
-               jbd_debug(3, "Handle %p stalling...\n", handle);
-               wait_event(journal->j_wait_transaction_locked,
-                               transaction->t_state != T_LOCKED);
+               schedule();
+               finish_wait(&journal->j_wait_transaction_locked, &wait);
                goto repeat;
        }