summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAlexey Khoroshilov <khoroshilov@ispras.ru>2012-11-05 22:40:14 +0400
committerArtem Bityutskiy <artem.bityutskiy@linux.intel.com>2012-11-18 11:59:01 +0200
commit2cbba75a56ea78e6876b4e2547a882f10b3fe72b (patch)
tree5a3789fbc954d829605e0bd3d5fa49bedcfcbbc9
parentd68cbdd4fb04d2b756ad53c22f36943167b16340 (diff)
downloadlinux-stable-2cbba75a56ea78e6876b4e2547a882f10b3fe72b.tar.gz
linux-stable-2cbba75a56ea78e6876b4e2547a882f10b3fe72b.tar.bz2
linux-stable-2cbba75a56ea78e6876b4e2547a882f10b3fe72b.zip
jffs2: hold erase_completion_lock on exit
Users of jffs2_do_reserve_space() expect they still held erase_completion_lock after call to it. But there is a path where jffs2_do_reserve_space() leaves erase_completion_lock unlocked. The patch fixes it. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Cc: stable@vger.kernel.org Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
-rw-r--r--fs/jffs2/nodemgmt.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/jffs2/nodemgmt.c b/fs/jffs2/nodemgmt.c
index 0c96eb52c797..03310721712f 100644
--- a/fs/jffs2/nodemgmt.c
+++ b/fs/jffs2/nodemgmt.c
@@ -417,14 +417,16 @@ static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize,
spin_unlock(&c->erase_completion_lock);
ret = jffs2_prealloc_raw_node_refs(c, jeb, 1);
- if (ret)
- return ret;
+
/* Just lock it again and continue. Nothing much can change because
we hold c->alloc_sem anyway. In fact, it's not entirely clear why
we hold c->erase_completion_lock in the majority of this function...
but that's a question for another (more caffeine-rich) day. */
spin_lock(&c->erase_completion_lock);
+ if (ret)
+ return ret;
+
waste = jeb->free_size;
jffs2_link_node_ref(c, jeb,
(jeb->offset + c->sector_size - waste) | REF_OBSOLETE,