From patchwork Mon Jan 28 01:28:32 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adam Thomas X-Patchwork-Id: 216092 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from merlin.infradead.org (merlin.infradead.org [IPv6:2001:4978:20e::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 44F0B2C0093 for ; Mon, 28 Jan 2013 12:30:04 +1100 (EST) Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.76 #1 (Red Hat Linux)) id 1TzdWy-0000hq-4g; Mon, 28 Jan 2013 01:29:04 +0000 Received: from mail-pb0-f47.google.com ([209.85.160.47]) by merlin.infradead.org with esmtps (Exim 4.76 #1 (Red Hat Linux)) id 1TzdWv-0000h9-He for linux-mtd@lists.infradead.org; Mon, 28 Jan 2013 01:29:02 +0000 Received: by mail-pb0-f47.google.com with SMTP id rp8so384893pbb.20 for ; Sun, 27 Jan 2013 17:29:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:from:to:cc:subject:date:message-id:x-mailer:in-reply-to :references; bh=LdcSfFcNIg7LtBI7hn3Sy646AyjOb90/iVJ55gJ+zSc=; b=IeYzsJ555h7ONujibUJJGXWRHDhqR7SvTYkrv2veCegmBMdGgHDySnvgD2zb6bSFCT 3fBNQNnp5LNC04krj0Rl1HX+zItqpaW7m5jF4OppJB4wdC5t7gkbUm9uOulIDTi7ClQC UzWcDHmlUd8TzXt76Ezx9IBkQZY2CsCM39R9tIdO1vvKXEVrS2sKx8fBhRDbWvsNh13L okIulI6KWP4iJ0b19Si7BTdgFq7NAedY1XGjj5nzaS+aOJzUgI84rDoggQ1M3dN5e53q jpeBlV0/px+YFfyLwIjOnHmBk0yj6d7CYS6M2pkbQr5bVkC1ZP3VV6zSWxKhrBmehW9P ndog== X-Received: by 10.68.230.135 with SMTP id sy7mr33781301pbc.76.1359336539953; Sun, 27 Jan 2013 17:28:59 -0800 (PST) Received: from ip-10-252-80-196.us-west-2.compute.internal (ec2-50-112-217-64.us-west-2.compute.amazonaws.com. [50.112.217.64]) by mx.google.com with ESMTPS id qh4sm5238851pbb.9.2013.01.27.17.28.58 (version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sun, 27 Jan 2013 17:28:59 -0800 (PST) From: Adam Thomas To: linux-mtd@lists.infradead.org Subject: [PATCH 1/2] UBIFS: fix use of freed ubifs_orphan objects Date: Mon, 28 Jan 2013 01:28:32 +0000 Message-Id: <1359336513-6259-2-git-send-email-adamthomas1111@gmail.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1359336513-6259-1-git-send-email-adamthomas1111@gmail.com> References: <1359336513-6259-1-git-send-email-adamthomas1111@gmail.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20130127_202901_771060_84531BE8 X-CRM114-Status: GOOD ( 15.45 ) X-Spam-Score: -2.5 (--) X-Spam-Report: SpamAssassin version 3.3.2 on merlin.infradead.org summary: Content analysis details: (-2.5 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.160.47 listed in list.dnswl.org] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (adamthomas1111[at]gmail.com) -0.0 SPF_PASS SPF: sender matches SPF record 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (adamthomas1111[at]gmail.com) -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature Cc: Adam Thomas X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: linux-mtd-bounces@lists.infradead.org Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The last orphan in the cnext list has its cnext set to NULL. Because of that, ubifs_delete_orphan assumes that it is not on the cnext list and frees it immediately instead of adding it to the dnext list. The freed orphan is later modified by write_orph_node. This can cause various inconsistencies including directory entries that cannot be removed and this error: UBIFS error (pid 20685): layout_cnodes: LPT out of space at LEB 14:129009 needing 17, done_ltab 1, done_lsave 1 This is a regression introduced by "7074e5eb UBIFS: remove invalid reference to list iterator variable". This change adds an explicit flag to ubifs_orphan indicating whether it is pending commit. --- fs/ubifs/orphan.c | 6 +++++- fs/ubifs/ubifs.h | 4 +++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c index 769701c..8433f53 100644 --- a/fs/ubifs/orphan.c +++ b/fs/ubifs/orphan.c @@ -132,7 +132,7 @@ void ubifs_delete_orphan(struct ubifs_info *c, ino_t inum) (unsigned long)inum); return; } - if (o->cnext) { + if (o->cmt) { o->dnext = c->orph_dnext; c->orph_dnext = o; spin_unlock(&c->orphan_lock); @@ -172,7 +172,9 @@ int ubifs_orphan_start_commit(struct ubifs_info *c) last = &c->orph_cnext; list_for_each_entry(orphan, &c->orph_new, new_list) { ubifs_assert(orphan->new); + ubifs_assert(!orphan->cmt); orphan->new = 0; + orphan->cmt = 1; *last = orphan; last = &orphan->cnext; } @@ -299,6 +301,7 @@ static int write_orph_node(struct ubifs_info *c, int atomic) cnext = c->orph_cnext; for (i = 0; i < cnt; i++) { orphan = cnext; + ubifs_assert(orphan->cmt); orph->inos[i] = cpu_to_le64(orphan->inum); cnext = orphan->cnext; orphan->cnext = NULL; @@ -378,6 +381,7 @@ static int consolidate(struct ubifs_info *c) list_for_each_entry(orphan, &c->orph_list, list) { if (orphan->new) continue; + orphan->cmt = 1; *last = orphan; last = &orphan->cnext; cnt += 1; diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h index d133c27..c16fff7 100644 --- a/fs/ubifs/ubifs.h +++ b/fs/ubifs/ubifs.h @@ -904,6 +904,7 @@ struct ubifs_budget_req { * @dnext: next orphan to delete * @inum: inode number * @new: %1 => added since the last commit, otherwise %0 + * @cmt: %1 => commit pending, otherwise %0 */ struct ubifs_orphan { struct rb_node rb; @@ -912,7 +913,8 @@ struct ubifs_orphan { struct ubifs_orphan *cnext; struct ubifs_orphan *dnext; ino_t inum; - int new; + unsigned new:1; + unsigned cmt:1; }; /**