jffs2: hold erase_completion_lock on exit (2cbba75a) · Commits · 戴 / test

Users of jffs2_do_reserve_space() expect they still held erase_completion_lock after call to it. But there is a path where jffs2_do_reserve_space() leaves erase_completion_lock unlocked. The patch fixes it. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by:

Alexey Khoroshilov <khoroshilov@ispras.ru> Cc: stable@vger.kernel.org Signed-off-by:

Artem Bityutskiy <artem.bityutskiy@linux.intel.com>

fs/jffs2/nodemgmt.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -417,14 +417,16 @@ static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize,
		spin_unlock(&c->erase_completion_lock);

		ret = jffs2_prealloc_raw_node_refs(c, jeb, 1);
		if (ret)
		return ret;

		/* Just lock it again and continue. Nothing much can change because
		we hold c->alloc_sem anyway. In fact, it's not entirely clear why
		we hold c->erase_completion_lock in the majority of this function...
		but that's a question for another (more caffeine-rich) day. */
		spin_lock(&c->erase_completion_lock);

		if (ret)
		return ret;

		waste = jeb->free_size;
		jffs2_link_node_ref(c, jeb,
		(jeb->offset + c->sector_size - waste) \| REF_OBSOLETE,

Admin message