diff options
| author | Alexey Khoroshilov <khoroshilov@ispras.ru> | 2012-11-05 22:40:14 +0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-01-17 08:43:55 -0800 |
| commit | 43f5d330de7b4238cd4c0b3f287218e1734332af (patch) | |
| tree | bd779da295d374d7af32e5e172464acc9e2c1b0c | |
| parent | 113b47f82db411f22e10cfa374328031cc394976 (diff) | |
| download | kernel_samsung_smdk4412-43f5d330de7b4238cd4c0b3f287218e1734332af.zip kernel_samsung_smdk4412-43f5d330de7b4238cd4c0b3f287218e1734332af.tar.gz kernel_samsung_smdk4412-43f5d330de7b4238cd4c0b3f287218e1734332af.tar.bz2 | |
jffs2: hold erase_completion_lock on exit
commit 2cbba75a56ea78e6876b4e2547a882f10b3fe72b upstream.
Users of jffs2_do_reserve_space() expect they still held
erase_completion_lock after call to it. But there is a path
where jffs2_do_reserve_space() leaves erase_completion_lock unlocked.
The patch fixes it.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/jffs2/nodemgmt.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/jffs2/nodemgmt.c b/fs/jffs2/nodemgmt.c index 694aa5b..e304795 100644 --- a/fs/jffs2/nodemgmt.c +++ b/fs/jffs2/nodemgmt.c @@ -355,14 +355,16 @@ static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize, spin_unlock(&c->erase_completion_lock); ret = jffs2_prealloc_raw_node_refs(c, jeb, 1); - if (ret) - return ret; + /* Just lock it again and continue. Nothing much can change because we hold c->alloc_sem anyway. In fact, it's not entirely clear why we hold c->erase_completion_lock in the majority of this function... but that's a question for another (more caffeine-rich) day. */ spin_lock(&c->erase_completion_lock); + if (ret) + return ret; + waste = jeb->free_size; jffs2_link_node_ref(c, jeb, (jeb->offset + c->sector_size - waste) | REF_OBSOLETE, |