rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: ** DISPUTED ** Integer signedness error in the pmcraid_ioctl_passthrough function in drivers/scsi/pmcraid.c in the Linux kernel before 3.1 might allow local users to cause a denial of service (memory consumption or memory corruption) via a negative size value in an ioctl call.  NOTE: this may be a vulnerability only in unusual environments that provide a privileged program for obtaining the required file descriptor.
Vulnerability ID: CVE-2011-2906
CWE: CWE-400
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-05-24
File: drivers/scsi/pmcraid.c
Commit message: [SCSI] pmcraid: reject negative request size

There's a code path in pmcraid that can be reached via device ioctl that
causes all sorts of ugliness, including heap corruption or triggering the
OOM killer due to consecutive allocation of large numbers of pages.

First, the user can call pmcraid_chr_ioctl(), with a type
PMCRAID_PASSTHROUGH_IOCTL.  This calls through to
pmcraid_ioctl_passthrough().  Next, a pmcraid_passthrough_ioctl_buffer
is copied in, and the request_size variable is set to
buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit
signed value provided by the user.  If a negative value is provided
here, bad things can happen.  For example,
pmcraid_build_passthrough_ioadls() is called with this request_size,
which immediately calls pmcraid_alloc_sglist() with a negative size.
The resulting math on allocating a scatter list can result in an
overflow in the kzalloc() call (if num_elem is 0, the sglist will be
smaller than expected), or if num_elem is unexpectedly large the
subsequent loop will call alloc_pages() repeatedly, a high number of
pages will be allocated and the OOM killer might be invoked.

It looks like preventing this value from being negative in
pmcraid_ioctl_passthrough() would be sufficient.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Commit author: Dan Rosenberg

Vulnerable version (before fix):
 static long pmcraid_ioctl_passthrough( 			pmcraid_err("couldn't build passthrough ioadls\n"); 			goto out_free_buffer; 		} 	}  	/* If data is being written into the device, copy the data from user

Fixed version (after fix):
 static long pmcraid_ioctl_passthrough( 			pmcraid_err("couldn't build passthrough ioadls\n"); 			goto out_free_buffer; 		} 	} else if (request_size < 0) { 		rc = -EINVAL; 		goto out_free_buffer; 	}  	/* If data is being written into the device, copy the data from user

Patch:
patch: @@ -3871,6 +3871,9 @@ static long pmcraid_ioctl_passthrough(
 			pmcraid_err("couldn't build passthrough ioadls\n");
 			goto out_free_buffer;
 		}
+	} else if (request_size < 0) {
+		rc = -EINVAL;
+		goto out_free_buffer;
 	}
 
 	/* If data is being written into the device, copy the data from user
path: drivers/scsi/pmcraid.c
Vulnerability: The do_devinfo_ioctl function in drivers/staging/comedi/comedi_fops.c in the Linux kernel before 3.1 allows local users to obtain sensitive information from kernel memory via a copy of a short string.
Vulnerability ID: CVE-2011-2909
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2014-02-15
File: drivers/staging/comedi/comedi_fops.c
Commit message: staging: comedi: fix infoleak to userspace

driver_name and board_name are pointers to strings, not buffers of size
COMEDI_NAMELEN.  Copying COMEDI_NAMELEN bytes of a string containing
less than COMEDI_NAMELEN-1 bytes would leak some unrelated bytes.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Commit author: Vasiliy Kulikov

Vulnerable version (before fix):
 static int do_devinfo_ioctl(struct comedi_device *dev, 	/* fill devinfo structure */ 	devinfo.version_code = COMEDI_VERSION_CODE; 	devinfo.n_subdevs = dev->n_subdevices; 	memcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN); 	memcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);  	if (read_subdev) 		devinfo.read_subdevice = read_subdev - dev->subdevices;

Fixed version (after fix):
 static int do_devinfo_ioctl(struct comedi_device *dev, 	/* fill devinfo structure */ 	devinfo.version_code = COMEDI_VERSION_CODE; 	devinfo.n_subdevs = dev->n_subdevices; 	strlcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN); 	strlcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);  	if (read_subdev) 		devinfo.read_subdevice = read_subdev - dev->subdevices;

Patch:
patch: @@ -383,8 +383,8 @@ static int do_devinfo_ioctl(struct comedi_device *dev,
 	/* fill devinfo structure */
 	devinfo.version_code = COMEDI_VERSION_CODE;
 	devinfo.n_subdevs = dev->n_subdevices;
-	memcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
-	memcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
+	strlcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
+	strlcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
 
 	if (read_subdev)
 		devinfo.read_subdevice = read_subdev - dev->subdevices;
path: drivers/staging/comedi/comedi_fops.c
Vulnerability: Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c in the Linux kernel before 3.1 allows remote CIFS servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large length value in a response to a read request for a directory.
Vulnerability ID: CVE-2011-3191
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2012-05-24
File: fs/cifs/cifssmb.c
Commit message: cifs: fix possible memory corruption in CIFSFindNext

The name_len variable in CIFSFindNext is a signed int that gets set to
the resume_name_len in the cifs_search_info. The resume_name_len however
is unsigned and for some infolevels is populated directly from a 32 bit
value sent by the server.

If the server sends a very large value for this, then that value could
look negative when converted to a signed int. That would make that
value pass the PATH_MAX check later in CIFSFindNext. The name_len would
then be used as a length value for a memcpy. It would then be treated
as unsigned again, and the memcpy scribbles over a ton of memory.

Fix this by making the name_len an unsigned value in CIFSFindNext.

Cc: <stable@kernel.org>
Reported-by: Darren Lavender <dcl@hppine99.gbr.hp.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Commit author: Jeff Layton

Vulnerable version (before fix):
 int CIFSFindNext(const int xid, struct cifs_tcon *tcon, 	T2_FNEXT_RSP_PARMS *parms; 	char *response_data; 	int rc = 0; 	int bytes_returned, name_len; 	__u16 params, byte_count;  	cFYI(1, "In FindNext");

Fixed version (after fix):
 int CIFSFindNext(const int xid, struct cifs_tcon *tcon, 	T2_FNEXT_RSP_PARMS *parms; 	char *response_data; 	int rc = 0; 	int bytes_returned; 	unsigned int name_len; 	__u16 params, byte_count;  	cFYI(1, "In FindNext");

Patch:
patch: @@ -4079,7 +4079,8 @@ int CIFSFindNext(const int xid, struct cifs_tcon *tcon,
 	T2_FNEXT_RSP_PARMS *parms;
 	char *response_data;
 	int rc = 0;
-	int bytes_returned, name_len;
+	int bytes_returned;
+	unsigned int name_len;
 	__u16 params, byte_count;
 
 	cFYI(1, "In FindNext");
path: fs/cifs/cifssmb.c
Vulnerability: Buffer overflow in the fuse_notify_inval_entry function in fs/fuse/dev.c in the Linux kernel before 3.1 allows local users to cause a denial of service (BUG_ON and system crash) by leveraging the ability to mount a FUSE filesystem.
Vulnerability ID: CVE-2011-3353
CWE: CWE-120
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-05-24
File: fs/fuse/dev.c
Commit message: fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message

FUSE_NOTIFY_INVAL_ENTRY didn't check the length of the write so the
message processing could overrun and result in a "kernel BUG at
fs/fuse/dev.c:629!"

Reported-by: Han-Wen Nienhuys <hanwenn@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: stable@kernel.org
Commit author: Miklos Szeredi

Vulnerable version (before fix):
 static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size, 	if (outarg.namelen > FUSE_NAME_MAX) 		goto err;  	name.name = buf; 	name.len = outarg.namelen; 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);

Fixed version (after fix):
 static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size, 	if (outarg.namelen > FUSE_NAME_MAX) 		goto err;  	err = -EINVAL; 	if (size != sizeof(outarg) + outarg.namelen + 1) 		goto err;  	name.name = buf; 	name.len = outarg.namelen; 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);

Patch:
patch: @@ -1358,6 +1358,10 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
 	if (outarg.namelen > FUSE_NAME_MAX)
 		goto err;
 
+	err = -EINVAL;
+	if (size != sizeof(outarg) + outarg.namelen + 1)
+		goto err;
+
 	name.name = buf;
 	name.len = outarg.namelen;
 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
path: fs/fuse/dev.c
Vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in config_defaults_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO, as demonstrated by the PATH_INFO to (1) manage_config_email_page.php, (2) manage_config_workflow_page.php, or (3) bugs/plugin.php.
Vulnerability ID: CVE-2011-3356
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2011-09-21
File: config_defaults_inc.php
Commit message: Fix issue introduced previously whereby php_Self is now used unchecked.

introduced previously by john attempting to fix symlinks. Since we now use php 5.2, we can make use of filter_var.

This is a simpler version of what we were trying to do previously aka http://git.mantisforge.org/w/mantisbt.git?a=commitdiff;h=5ac1fdf32717d0c82cca7e7660dd4fd316a6a1b8

Depending on server/mantis config this can lead to XSS issues

David: Backported from master branch and removed unreachable code branch.

Signed-off-by: David Hicks <d@hx.id.au>
Commit author: Paul Richards

Vulnerable version (before fix):
 			$t_host = 'localhost'; 		}  		$t_path = str_replace( basename( $_SERVER['PHP_SELF'] ), '', $_SERVER['PHP_SELF'] ); 		$t_path = basename( $t_path ) == "admin" ? dirname( $t_path ) . '/' : $t_path; 		$t_path = basename( $t_path ) == "soap" ? dirname( dirname( $t_path ) ) . '/' : $t_path; 		  		$t_url	= $t_protocol . '://' . $t_host . $t_path; 

Fixed version (after fix):
 			$t_host = 'localhost'; 		}  		$t_self = $_SERVER['SCRIPT_NAME']; 		$t_self = filter_var( $t_self, FILTER_SANITIZE_STRING ); 		$t_path = str_replace( basename( $t_self ), '', $t_self ); 		$t_path = basename( $t_path ) == "admin" ? dirname( $t_path ) . '/' : $t_path; 		$t_path = basename( $t_path ) == "soap" ? dirname( dirname( $t_path ) ) . '/' : $t_path; 		if ( strpos( $t_path, '&#' ) ) { 			echo 'Can not safely determine $g_path. Please set $g_path manually in config_inc.php'; 			die; 		}  		$t_url	= $t_protocol . '://' . $t_host . $t_path; 

Patch:
patch: @@ -112,10 +112,15 @@
 			$t_host = 'localhost';
 		}
 
-		$t_path = str_replace( basename( $_SERVER['PHP_SELF'] ), '', $_SERVER['PHP_SELF'] );
+		$t_self = $_SERVER['SCRIPT_NAME'];
+		$t_self = filter_var( $t_self, FILTER_SANITIZE_STRING );
+		$t_path = str_replace( basename( $t_self ), '', $t_self );
 		$t_path = basename( $t_path ) == "admin" ? dirname( $t_path ) . '/' : $t_path;
 		$t_path = basename( $t_path ) == "soap" ? dirname( dirname( $t_path ) ) . '/' : $t_path;
-		
+		if ( strpos( $t_path, '&#' ) ) {
+			echo 'Can not safely determine $g_path. Please set $g_path manually in config_inc.php';
+			die;
+		}
 
 		$t_url	= $t_protocol . '://' . $t_host . $t_path;
path: config_defaults_inc.php
Vulnerability: The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a share.
Vulnerability ID: CVE-2011-3363
CWE: CWE-20
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-05-24
File: fs/cifs/connect.c
Commit message: cifs: always do is_path_accessible check in cifs_mount

Currently, we skip doing the is_path_accessible check in cifs_mount if
there is no prefixpath. I have a report of at least one server however
that allows a TREE_CONNECT to a share that has a DFS referral at its
root. The reporter in this case was using a UNC that had no prefixpath,
so the is_path_accessible check was not triggered and the box later hit
a BUG() because we were chasing a DFS referral on the root dentry for
the mount.

This patch fixes this by removing the check for a zero-length
prefixpath.  That should make the is_path_accessible check be done in
this situation and should allow the client to chase the DFS referral at
mount time instead.

Cc: stable@kernel.org
Reported-and-Tested-by: Yogesh Sharma <ysharma@cymer.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Commit author: Jeff Layton

Vulnerable version (before fix):
 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,  remote_path_check: 	/* check if a whole path (including prepath) is not remote */ 	if (!rc && cifs_sb->prepathlen && tcon) { 		/* build_path_to_root works only when we have a valid tcon */ 		full_path = cifs_build_path_to_root(cifs_sb, tcon); 		if (full_path == NULL) {

Fixed version (after fix):
 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,  remote_path_check: 	/* check if a whole path (including prepath) is not remote */ 	if (!rc && tcon) { 		/* build_path_to_root works only when we have a valid tcon */ 		full_path = cifs_build_path_to_root(cifs_sb, tcon); 		if (full_path == NULL) {

Patch:
patch: @@ -2831,7 +2831,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
 
 remote_path_check:
 	/* check if a whole path (including prepath) is not remote */
-	if (!rc && cifs_sb->prepathlen && tcon) {
+	if (!rc && tcon) {
 		/* build_path_to_root works only when we have a valid tcon */
 		full_path = cifs_build_path_to_root(cifs_sb, tcon);
 		if (full_path == NULL) {
path: fs/cifs/connect.c
Vulnerability: Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name.  NOTE: this can be leveraged with a symlink to overwrite arbitrary files.
Vulnerability ID: CVE-2011-3602
CWE: CWE-22
Severity score: 4.9
Project: https://github.com/reubenhwk/radvd
Published: 2014-04-27
File: device-linux.c
Commit message: set_interface_var() doesn't check interface name and blindly does
fopen(path "/" ifname, "w") on it.  As "ifname" is an untrusted input, it
should be checked for ".." and/or "/" in it.  Otherwise, an infected
unprivileged daemon may overwrite contents of file named "mtu",
"hoplimit", etc. in arbitrary location with arbitrary 32-bit value in
decimal representation ("%d").  If an attacker has a local account or
may create arbitrary symlinks with these names in any location (e.g.
/tmp), any file may be overwritten with a decimal value.
Commit author: Vasiliy Kulikov

Vulnerable version (before fix):
 set_interface_var(const char *iface, 	if (snprintf(spath, sizeof(spath), var, iface) >= sizeof(spath)) 		return -1;  	if (access(spath, F_OK) != 0) 		return -1; 

Fixed version (after fix):
 set_interface_var(const char *iface, 	if (snprintf(spath, sizeof(spath), var, iface) >= sizeof(spath)) 		return -1;  	/* No path traversal */ 	if (strstr(name, "..") || strchr(name, '/')) 		return -1;  	if (access(spath, F_OK) != 0) 		return -1; 

Patch:
patch: @@ -243,6 +243,10 @@ set_interface_var(const char *iface,
 	if (snprintf(spath, sizeof(spath), var, iface) >= sizeof(spath))
 		return -1;
 
+	/* No path traversal */
+	if (strstr(name, "..") || strchr(name, '/'))
+		return -1;
+
 	if (access(spath, F_OK) != 0)
 		return -1;
path: device-linux.c
Vulnerability: The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 3.0 does not properly handle invalid parameters, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by writing to a /proc/#####/attr/current file.
Vulnerability ID: CVE-2011-3619
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2013-06-08
File: security/apparmor/lsm.c
Commit message: AppArmor: fix oops in apparmor_setprocattr

When invalid parameters are passed to apparmor_setprocattr a NULL deref
oops occurs when it tries to record an audit message. This is because
it is passing NULL for the profile parameter for aa_audit. But aa_audit
now requires that the profile passed is not NULL.

Fix this by passing the current profile on the task that is trying to
setprocattr.

Signed-off-by: Kees Cook <kees@ubuntu.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Cc: stable@kernel.org
Signed-off-by: James Morris <jmorris@namei.org>
Commit author: Kees Cook

Vulnerable version (before fix):
 static int apparmor_setprocattr(struct task_struct *task, char *name, 			sa.aad.op = OP_SETPROCATTR; 			sa.aad.info = name; 			sa.aad.error = -EINVAL; 			return aa_audit(AUDIT_APPARMOR_DENIED, NULL, GFP_KERNEL, 					&sa, NULL); 		} 	} else if (strcmp(name, "exec") == 0) {

Fixed version (after fix):
 static int apparmor_setprocattr(struct task_struct *task, char *name, 			sa.aad.op = OP_SETPROCATTR; 			sa.aad.info = name; 			sa.aad.error = -EINVAL; 			return aa_audit(AUDIT_APPARMOR_DENIED, 					__aa_current_profile(), GFP_KERNEL, 					&sa, NULL); 		} 	} else if (strcmp(name, "exec") == 0) {

Patch:
patch: @@ -593,7 +593,8 @@ static int apparmor_setprocattr(struct task_struct *task, char *name,
 			sa.aad.op = OP_SETPROCATTR;
 			sa.aad.info = name;
 			sa.aad.error = -EINVAL;
-			return aa_audit(AUDIT_APPARMOR_DENIED, NULL, GFP_KERNEL,
+			return aa_audit(AUDIT_APPARMOR_DENIED,
+					__aa_current_profile(), GFP_KERNEL,
 					&sa, NULL);
 		}
 	} else if (strcmp(name, "exec") == 0) {
path: security/apparmor/lsm.c
Vulnerability: The m_stop function in fs/proc/task_mmu.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (OOPS) via vectors that trigger an m_start error.
Vulnerability ID: CVE-2011-3637
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-05-17
File: fs/proc/task_mmu.c
Commit message: proc: fix oops on invalid /proc/<pid>/maps access

When m_start returns an error, the seq_file logic will still call m_stop
with that error entry, so we'd better make sure that we check it before
using it as a vma.

Introduced by commit ec6fd8a4355c ("report errors in /proc/*/*map*
sanely"), which replaced NULL with various ERR_PTR() cases.

(On ia64, you happen to get a unaligned fault instead of a page fault,
since the address used is generally some random error code like -EPERM)

Reported-by: Anca Emanuel <anca.emanuel@gmail.com>
Reported-by: Tony Luck <tony.luck@intel.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Américo Wang <xiyou.wangcong@gmail.com>
Cc: Stephen Wilson <wilsons@start.ca>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Linus Torvalds

Vulnerable version (before fix):
 static void m_stop(struct seq_file *m, void *v) 	struct proc_maps_private *priv = m->private; 	struct vm_area_struct *vma = v;  	vma_stop(priv, vma); 	if (priv->task) 		put_task_struct(priv->task); }

Fixed version (after fix):
 static void m_stop(struct seq_file *m, void *v) 	struct proc_maps_private *priv = m->private; 	struct vm_area_struct *vma = v;  	if (!IS_ERR(vma)) 		vma_stop(priv, vma); 	if (priv->task) 		put_task_struct(priv->task); }

Patch:
patch: @@ -182,7 +182,8 @@ static void m_stop(struct seq_file *m, void *v)
 	struct proc_maps_private *priv = m->private;
 	struct vm_area_struct *vma = v;
 
-	vma_stop(priv, vma);
+	if (!IS_ERR(vma))
+		vma_stop(priv, vma);
 	if (priv->task)
 		put_task_struct(priv->task);
 }
path: fs/proc/task_mmu.c
Vulnerability: The journal_unmap_buffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the _Delay and _Unwritten buffer head states, which allows local users to cause a denial of service (system crash) by leveraging the presence of an ext4 filesystem that was mounted with a journal.
Vulnerability ID: CVE-2011-4086
CWE: CWE-119
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-07-03
File: fs/jbd2/transaction.c
Commit message: jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer

journal_unmap_buffer()'s zap_buffer: code clears a lot of buffer head
state ala discard_buffer(), but does not touch _Delay or _Unwritten as
discard_buffer() does.

This can be problematic in some areas of the ext4 code which assume
that if they have found a buffer marked unwritten or delay, then it's
a live one.  Perhaps those spots should check whether it is mapped
as well, but if jbd2 is going to tear down a buffer, let's really
tear it down completely.

Without this I get some fsx failures on sub-page-block filesystems
up until v3.2, at which point 4e96b2dbbf1d7e81f22047a50f862555a6cb87cb
and 189e868fa8fdca702eb9db9d8afc46b5cb9144c9 make the failures go
away, because buried within that large change is some more flag
clearing.  I still think it's worth doing in jbd2, since
->invalidatepage leads here directly, and it's the right place
to clear away these flags.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org
Commit author: Eric Sandeen

Vulnerable version (before fix):
 static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh) 	clear_buffer_mapped(bh); 	clear_buffer_req(bh); 	clear_buffer_new(bh); 	bh->b_bdev = NULL; 	return may_free; }

Fixed version (after fix):
 static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh) 	clear_buffer_mapped(bh); 	clear_buffer_req(bh); 	clear_buffer_new(bh); 	clear_buffer_delay(bh); 	clear_buffer_unwritten(bh); 	bh->b_bdev = NULL; 	return may_free; }

Patch:
patch: @@ -1949,6 +1949,8 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
 	clear_buffer_mapped(bh);
 	clear_buffer_req(bh);
 	clear_buffer_new(bh);
+	clear_buffer_delay(bh);
+	clear_buffer_unwritten(bh);
 	bh->b_bdev = NULL;
 	return may_free;
 }
path: fs/jbd2/transaction.c