From patchwork Sat Feb 2 22:35:08 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adam Thomas X-Patchwork-Id: 217706 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from merlin.infradead.org (merlin.infradead.org [IPv6:2001:4978:20e::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 204272C0080 for ; Sun, 3 Feb 2013 09:36:24 +1100 (EST) Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.76 #1 (Red Hat Linux)) id 1U1lgQ-0001Aj-TC; Sat, 02 Feb 2013 22:35:38 +0000 Received: from mail-da0-f42.google.com ([209.85.210.42]) by merlin.infradead.org with esmtps (Exim 4.76 #1 (Red Hat Linux)) id 1U1lgO-0001A8-My for linux-mtd@lists.infradead.org; Sat, 02 Feb 2013 22:35:37 +0000 Received: by mail-da0-f42.google.com with SMTP id z17so2171399dal.15 for ; Sat, 02 Feb 2013 14:35:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:from:to:cc:subject:date:message-id:x-mailer:in-reply-to :references; bh=X8nXIfXmEXX5gKy2bfgjoUiW8O0gUJARtayqe7zrGrY=; b=TQJobyHRBwkgktt2797jvCvBFWCbVvRPgbZa2Yd0NJjJWet0WG12G0TZ+I49Fvq1Rx XJU9032YYpC70lGUdNE5G5ErTYj+NRs9MuIRlVXq2OLNRk1uKI/dVYG78FVFTf0Bg26v tRjtnpzZDmZ1Ey5mYGkgfBZVxmdMD4WMkpqWKsfbMYjylXd0roFjJ8noJn9VYToo7wax sAYVw9r9upxE57uimsaS1tFh4xaWtWbz4SRZaHN3/l4W9NUvT2sJNq7BsDqAr3E+/MUI lFMcgVu2B/f9MBu28KiCL39YfGC28AIQljqM7fwF93BQDn6UGk29d2jWzgXUO21YvChN QTuA== X-Received: by 10.68.189.66 with SMTP id gg2mr43341840pbc.111.1359844534872; Sat, 02 Feb 2013 14:35:34 -0800 (PST) Received: from ip-10-249-71-51.us-west-2.compute.internal (ec2-54-245-180-47.us-west-2.compute.amazonaws.com. [54.245.180.47]) by mx.google.com with ESMTPS id gj1sm12825645pbc.11.2013.02.02.14.35.33 (version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sat, 02 Feb 2013 14:35:34 -0800 (PST) From: Adam Thomas To: adrian.hunter@intel.com Subject: [PATCH v2 2/2] UBIFS: fix double free of ubifs_orphan objects Date: Sat, 2 Feb 2013 22:35:08 +0000 Message-Id: <1359844508-5932-1-git-send-email-adamthomas1111@gmail.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <510BC1DF.7010506@intel.com> References: <510BC1DF.7010506@intel.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20130202_173536_819652_BA0CBD19 X-CRM114-Status: GOOD ( 12.22 ) X-Spam-Score: -2.5 (--) X-Spam-Report: SpamAssassin version 3.3.2 on merlin.infradead.org summary: Content analysis details: (-2.5 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.210.42 listed in list.dnswl.org] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (adamthomas1111[at]gmail.com) -0.0 SPF_PASS SPF: sender matches SPF record 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (adamthomas1111[at]gmail.com) -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature Cc: linux-mtd@lists.infradead.org, adamthomas1111@gmail.com X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: linux-mtd-bounces@lists.infradead.org Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The last orphan in the dnext list has its dnext set to NULL. Because of that, ubifs_delete_orphan assumes that it is not on the dnext list and frees it immediately instead ignoring it as a second delete. The orphan is later freed again by erase_deleted. This change adds an explicit flag to ubifs_orphan indicating whether it is pending delete. Signed-off-by: Adam Thomas --- fs/ubifs/orphan.c | 5 ++++- fs/ubifs/ubifs.h | 2 ++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c index 8534d9c..ba32da3 100644 --- a/fs/ubifs/orphan.c +++ b/fs/ubifs/orphan.c @@ -126,13 +126,14 @@ void ubifs_delete_orphan(struct ubifs_info *c, ino_t inum) else if (inum > o->inum) p = p->rb_right; else { - if (o->dnext) { + if (o->del) { spin_unlock(&c->orphan_lock); dbg_gen("deleted twice ino %lu", (unsigned long)inum); return; } if (o->cmt) { + o->del = 1; o->dnext = c->orph_dnext; c->orph_dnext = o; spin_unlock(&c->orphan_lock); @@ -447,6 +448,7 @@ static void erase_deleted(struct ubifs_info *c) orphan = dnext; dnext = orphan->dnext; ubifs_assert(!orphan->new); + ubifs_assert(orphan->del); rb_erase(&orphan->rb, &c->orph_tree); list_del(&orphan->list); c->tot_orphans -= 1; @@ -536,6 +538,7 @@ static int insert_dead_orphan(struct ubifs_info *c, ino_t inum) rb_link_node(&orphan->rb, parent, p); rb_insert_color(&orphan->rb, &c->orph_tree); list_add_tail(&orphan->list, &c->orph_list); + orphan->del = 1; orphan->dnext = c->orph_dnext; c->orph_dnext = orphan; dbg_mnt("ino %lu, new %d, tot %d", (unsigned long)inum, diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h index c16fff7..b2babce 100644 --- a/fs/ubifs/ubifs.h +++ b/fs/ubifs/ubifs.h @@ -905,6 +905,7 @@ struct ubifs_budget_req { * @inum: inode number * @new: %1 => added since the last commit, otherwise %0 * @cmt: %1 => commit pending, otherwise %0 + * @del: %1 => delete pending, otherwise %0 */ struct ubifs_orphan { struct rb_node rb; @@ -915,6 +916,7 @@ struct ubifs_orphan { ino_t inum; unsigned new:1; unsigned cmt:1; + unsigned del:1; }; /**