Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2cbba75a authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Artem Bityutskiy
Browse files

jffs2: hold erase_completion_lock on exit 



Users of jffs2_do_reserve_space() expect they still held
erase_completion_lock after call to it. But there is a path
where jffs2_do_reserve_space() leaves erase_completion_lock unlocked.
The patch fixes it.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
parent d68cbdd4

fs/jffs2/nodemgmt.c

+4 −2
Original line number Diff line number Diff line
@@ -417,14 +417,16 @@ static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize, 
			spin_unlock(&c->erase_completion_lock);



			ret = jffs2_prealloc_raw_node_refs(c, jeb, 1);

			if (ret)

				return ret;



			/* Just lock it again and continue. Nothing much can change because

			   we hold c->alloc_sem anyway. In fact, it's not entirely clear why

			   we hold c->erase_completion_lock in the majority of this function...

			   but that's a question for another (more caffeine-rich) day. */

			spin_lock(&c->erase_completion_lock);



			if (ret)

				return ret;



			waste = jeb->free_size;

			jffs2_link_node_ref(c, jeb,

					    (jeb->offset + c->sector_size - waste) | REF_OBSOLETE,