[JFFS2] Fix free space leak with in-band cleanmarkers (014b164e) · Commits · 戴 / test

We were accounting for the cleanmarker by calling jffs2_link_node_ref() (without locking!), which adjusted both superblock and per-eraseblock accounting, subtracting the size of the cleanmarker from {jeb,c}->free_size and adding it to {jeb,c}->used_size. But only _then_ were we adding the size of the newly-erased block back to the superblock counts, and we were adding each of jeb->{free,used}_size to the corresponding superblock counts. Thus, the size of the cleanmarker was effectively subtracted from the superblock's free_size _twice_. Fix this, by always adding a full eraseblock size to c->free_size when we've erased a block. And call jffs2_link_node_ref() under the proper lock, while we're at it. Thanks to Alexander Yurchenko and/or Damir Shayhutdinov for (almost) pinpointing the problem. Signed-off-by:

David Woodhouse <dwmw2@infradead.org>

fs/jffs2/erase.c

+8 −10

Original line number	Diff line number	Diff line
		@@ -419,9 +419,6 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
		if (jffs2_write_nand_cleanmarker(c, jeb))
		goto filebad;
		}

		/* Everything else got zeroed before the erase */
		jeb->free_size = c->sector_size;
		} else {

		struct kvec vecs[1];
		@@ -449,18 +446,19 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb

		goto filebad;
		}

		}
		/* Everything else got zeroed before the erase */
		jeb->free_size = c->sector_size;
		/* FIXME Special case for cleanmarker in empty block */
		jffs2_link_node_ref(c, jeb, jeb->offset \| REF_NORMAL, c->cleanmarker_size, NULL);
		}

		mutex_lock(&c->erase_free_sem);
		spin_lock(&c->erase_completion_lock);

		c->erasing_size -= c->sector_size;
		c->free_size += jeb->free_size;
		c->used_size += jeb->used_size;
		c->free_size += c->sector_size;

		/* Account for cleanmarker now, if it's in-band */
		if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c))
		jffs2_link_node_ref(c, jeb, jeb->offset \| REF_NORMAL, c->cleanmarker_size, NULL);

		jffs2_dbg_acct_sanity_check_nolock(c,jeb);
		jffs2_dbg_acct_paranoia_check_nolock(c, jeb);

Admin message