Patchwork jffs2: Make handling of erase_completion_lock consistent in jffs2_do_reserve_space()

login
register
mail settings
Submitter Alexey Khoroshilov
Date Nov. 5, 2012, 6:40 p.m.
Message ID <1352140814-25208-1-git-send-email-khoroshilov@ispras.ru>
Download mbox | patch
Permalink /patch/197272/
State New
Headers show

Comments

Alexey Khoroshilov - Nov. 5, 2012, 6:40 p.m.
Users of jffs2_do_reserve_space() expect they still held
erase_completion_lock after call to it. But there is a path
where jffs2_do_reserve_space() leaves erase_completion_lock unlocked.
The patch fixes it.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
 fs/jffs2/nodemgmt.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
Artem Bityutskiy - Nov. 16, 2012, 9 a.m.
On Mon, 2012-11-05 at 22:40 +0400, Alexey Khoroshilov wrote:
> Users of jffs2_do_reserve_space() expect they still held
> erase_completion_lock after call to it. But there is a path
> where jffs2_do_reserve_space() leaves erase_completion_lock unlocked.
> The patch fixes it.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>

Pushed to l2-mtd.git, thanks!

Patch

diff --git a/fs/jffs2/nodemgmt.c b/fs/jffs2/nodemgmt.c
index 0c96eb5..0331072 100644
--- a/fs/jffs2/nodemgmt.c
+++ b/fs/jffs2/nodemgmt.c
@@ -417,14 +417,16 @@  static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize,
 			spin_unlock(&c->erase_completion_lock);
 
 			ret = jffs2_prealloc_raw_node_refs(c, jeb, 1);
-			if (ret)
-				return ret;
+
 			/* Just lock it again and continue. Nothing much can change because
 			   we hold c->alloc_sem anyway. In fact, it's not entirely clear why
 			   we hold c->erase_completion_lock in the majority of this function...
 			   but that's a question for another (more caffeine-rich) day. */
 			spin_lock(&c->erase_completion_lock);
 
+			if (ret)
+				return ret;
+
 			waste = jeb->free_size;
 			jffs2_link_node_ref(c, jeb,
 					    (jeb->offset + c->sector_size - waste) | REF_OBSOLETE,