Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 014b164e authored by David Woodhouse's avatar David Woodhouse
Browse files

[JFFS2] Fix free space leak with in-band cleanmarkers 



We were accounting for the cleanmarker by calling jffs2_link_node_ref()
(without locking!), which adjusted both superblock and per-eraseblock
accounting, subtracting the size of the cleanmarker from {jeb,c}->free_size
and adding it to {jeb,c}->used_size.

But only _then_ were we adding the size of the newly-erased block back
to the superblock counts, and we were adding each of jeb->{free,used}_size
to the corresponding superblock counts. Thus, the size of the cleanmarker
was effectively subtracted from the superblock's free_size _twice_.

Fix this, by always adding a full eraseblock size to c->free_size when
we've erased a block. And call jffs2_link_node_ref() under the proper
lock, while we're at it.

Thanks to Alexander Yurchenko and/or Damir Shayhutdinov for (almost)
pinpointing the problem.

Signed-off-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
parent cf9d1e42

fs/jffs2/erase.c

+8 −10
Original line number Diff line number Diff line
@@ -419,9 +419,6 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb 
			if (jffs2_write_nand_cleanmarker(c, jeb))

				goto filebad;

		}



		/* Everything else got zeroed before the erase */

		jeb->free_size = c->sector_size;

	} else {



		struct kvec vecs[1];
@@ -449,18 +446,19 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb 


			goto filebad;

		}



	}

	/* Everything else got zeroed before the erase */

	jeb->free_size = c->sector_size;

		/* FIXME Special case for cleanmarker in empty block */

		jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);

	}



	mutex_lock(&c->erase_free_sem);

	spin_lock(&c->erase_completion_lock);



	c->erasing_size -= c->sector_size;

	c->free_size += jeb->free_size;

	c->used_size += jeb->used_size;

	c->free_size += c->sector_size;



	/* Account for cleanmarker now, if it's in-band */

	if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c))

		jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);



	jffs2_dbg_acct_sanity_check_nolock(c,jeb);

	jffs2_dbg_acct_paranoia_check_nolock(c, jeb);