3 If ext3_add_nondir() fails it will do an iput() of the inode. But we
4 continue to run ext3_mark_inode_dirty() against the potentially-freed
5 inode. This oopses when slab poisoning is enabled.
7 Fix it so that we only run ext3_mark_inode_dirty() if the inode was
8 successfully instantiated.
10 This bug was added in 2.4.20-pre9.
13 fs/ext3/namei.c | 11 +++++------
14 1 files changed, 5 insertions(+), 6 deletions(-)
16 --- 24/fs/ext3/namei.c~ext3-use-after-free Sun Dec 15 11:27:50 2002
17 +++ 24-akpm/fs/ext3/namei.c Sun Dec 15 11:27:50 2002
18 @@ -429,8 +429,11 @@ static int ext3_add_nondir(handle_t *han
20 int err = ext3_add_entry(handle, dentry, inode);
22 - d_instantiate(dentry, inode);
24 + err = ext3_mark_inode_dirty(handle, inode);
26 + d_instantiate(dentry, inode);
30 ext3_dec_count(handle, inode);
32 @@ -465,7 +468,6 @@ static int ext3_create (struct inode * d
33 inode->i_fop = &ext3_file_operations;
34 inode->i_mapping->a_ops = &ext3_aops;
35 err = ext3_add_nondir(handle, dentry, inode);
36 - ext3_mark_inode_dirty(handle, inode);
38 ext3_journal_stop(handle, dir);
40 @@ -490,7 +492,6 @@ static int ext3_mknod (struct inode * di
42 init_special_inode(inode, mode, rdev);
43 err = ext3_add_nondir(handle, dentry, inode);
44 - ext3_mark_inode_dirty(handle, inode);
46 ext3_journal_stop(handle, dir);
48 @@ -934,7 +935,6 @@ static int ext3_symlink (struct inode *
50 inode->u.ext3_i.i_disksize = inode->i_size;
51 err = ext3_add_nondir(handle, dentry, inode);
52 - ext3_mark_inode_dirty(handle, inode);
54 ext3_journal_stop(handle, dir);
56 @@ -971,7 +971,6 @@ static int ext3_link (struct dentry * ol
57 atomic_inc(&inode->i_count);
59 err = ext3_add_nondir(handle, dentry, inode);
60 - ext3_mark_inode_dirty(handle, inode);
61 ext3_journal_stop(handle, dir);