jffs2: hold erase_completion_lock on exit
authorAlexey Khoroshilov <khoroshilov@ispras.ru>
Mon, 5 Nov 2012 18:40:14 +0000 (22:40 +0400)
committerArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
Sun, 18 Nov 2012 09:59:01 +0000 (11:59 +0200)
Users of jffs2_do_reserve_space() expect they still held
erase_completion_lock after call to it. But there is a path
where jffs2_do_reserve_space() leaves erase_completion_lock unlocked.
The patch fixes it.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: stable@vger.kernel.org
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
fs/jffs2/nodemgmt.c

index 0c96eb52c79783057862a2c8f66106fc2a424113..03310721712f7885aa043c1c2f88421d0a80649b 100644 (file)
@@ -417,14 +417,16 @@ static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize,
                        spin_unlock(&c->erase_completion_lock);
 
                        ret = jffs2_prealloc_raw_node_refs(c, jeb, 1);
-                       if (ret)
-                               return ret;
+
                        /* Just lock it again and continue. Nothing much can change because
                           we hold c->alloc_sem anyway. In fact, it's not entirely clear why
                           we hold c->erase_completion_lock in the majority of this function...
                           but that's a question for another (more caffeine-rich) day. */
                        spin_lock(&c->erase_completion_lock);
 
+                       if (ret)
+                               return ret;
+
                        waste = jeb->free_size;
                        jffs2_link_node_ref(c, jeb,
                                            (jeb->offset + c->sector_size - waste) | REF_OBSOLETE,