diff options
| author | Dave Chinner <david@fromorbit.com> | 2008-11-17 17:37:10 +1100 |
|---|---|---|
| committer | Lachlan McIlroy <lachlan@redback.melbourne.sgi.com> | 2008-11-17 17:37:10 +1100 |
| commit | cc09c0dc57de7f7d2ed89d480b5653e5f6a32f2c (patch) | |
| tree | 3c6145ccb00f603c47e020cfa45f159ab76cf9bf /fs/xfs/xfs_log_priv.h | |
| parent | 6307091fe69ae74747298bdcaf43119ad67bda3a (diff) | |
| download | linux-stable-cc09c0dc57de7f7d2ed89d480b5653e5f6a32f2c.tar.gz linux-stable-cc09c0dc57de7f7d2ed89d480b5653e5f6a32f2c.tar.bz2 linux-stable-cc09c0dc57de7f7d2ed89d480b5653e5f6a32f2c.zip | |
[XFS] Fix double free of log tickets
When an I/O error occurs during an intermediate commit on a rolling
transaction, xfs_trans_commit() will free the transaction structure
and the related ticket. However, the duplicate transaction that
gets used as the transaction continues still contains a pointer
to the ticket. Hence when the duplicate transaction is cancelled
and freed, we free the ticket a second time.
Add reference counting to the ticket so that we hold an extra
reference to the ticket over the transaction commit. We drop the
extra reference once we have checked that the transaction commit
did not return an error, thus avoiding a double free on commit
error.
Credit to Nick Piggin for tripping over the problem.
SGI-PV: 989741
Signed-off-by: Dave Chinner <david@fromorbit.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
Diffstat (limited to 'fs/xfs/xfs_log_priv.h')
| -rw-r--r-- | fs/xfs/xfs_log_priv.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h index de7ef6ca9206..b39a1980e82d 100644 --- a/fs/xfs/xfs_log_priv.h +++ b/fs/xfs/xfs_log_priv.h @@ -245,6 +245,7 @@ typedef struct xlog_ticket { struct xlog_ticket *t_next; /* :4|8 */ struct xlog_ticket *t_prev; /* :4|8 */ xlog_tid_t t_tid; /* transaction identifier : 4 */ + atomic_t t_ref; /* ticket reference count : 4 */ int t_curr_res; /* current reservation in bytes : 4 */ int t_unit_res; /* unit reservation in bytes : 4 */ char t_ocnt; /* original count : 1 */ |