• Dave Chinner's avatar
    [XFS] Fix double free of log tickets · cc09c0dc
    Dave Chinner authored
    When an I/O error occurs during an intermediate commit on a rolling
    transaction, xfs_trans_commit() will free the transaction structure
    and the related ticket. However, the duplicate transaction that
    gets used as the transaction continues still contains a pointer
    to the ticket. Hence when the duplicate transaction is cancelled
    and freed, we free the ticket a second time.
    
    Add reference counting to the ticket so that we hold an extra
    reference to the ticket over the transaction commit. We drop the
    extra reference once we have checked that the transaction commit
    did not return an error, thus avoiding a double free on commit
    error.
    
    Credit to Nick Piggin for tripping over the problem.
    
    SGI-PV: 989741
    Signed-off-by: default avatarDave Chinner <david@fromorbit.com>
    Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
    Signed-off-by: default avatarLachlan McIlroy <lachlan@sgi.com>
    cc09c0dc
xfs_trans.c 38.7 KB