Commit 21eeb7aa authored by Thomas Gleixner's avatar Thomas Gleixner

[JFFS2] Fix the slab cache constructor of 'struct jffs2_inode_info' objects.

JFFS2 initialize f->sem mutex as "locked" in the slab constructor which is a
bug. Objects are freed with unlocked f->sem mutex. So, when they allocated
again, f->sem is unlocked because the slab cache constructor is not called for
them. The constructor is called only once when memory pages are allocated for
objects (namely, when the slab layer allocates new slabs). So, sometimes
'struct jffs2_inode_info' are allocated with unlocked f->sem, sometimes with
locked. This is a bug. Instead, initialize f->sem as unlocked in the
constructor. I.e., in the "constructed" state f->sem must be unlocked.

From: Keijiro Yano <keijiro_yano@yahoo.co.jp>
Acked-by: default avatarArtem B. Bityutskiy <dedekind@infradead.org>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
parent bc4117f8
...@@ -234,6 +234,7 @@ void jffs2_read_inode (struct inode *inode) ...@@ -234,6 +234,7 @@ void jffs2_read_inode (struct inode *inode)
c = JFFS2_SB_INFO(inode->i_sb); c = JFFS2_SB_INFO(inode->i_sb);
jffs2_init_inode_info(f); jffs2_init_inode_info(f);
down(&f->sem);
ret = jffs2_do_read_inode(c, f, inode->i_ino, &latest_node); ret = jffs2_do_read_inode(c, f, inode->i_ino, &latest_node);
...@@ -400,6 +401,7 @@ struct inode *jffs2_new_inode (struct inode *dir_i, int mode, struct jffs2_raw_i ...@@ -400,6 +401,7 @@ struct inode *jffs2_new_inode (struct inode *dir_i, int mode, struct jffs2_raw_i
f = JFFS2_INODE_INFO(inode); f = JFFS2_INODE_INFO(inode);
jffs2_init_inode_info(f); jffs2_init_inode_info(f);
down(&f->sem);
memset(ri, 0, sizeof(*ri)); memset(ri, 0, sizeof(*ri));
/* Set OS-specific defaults for new inodes */ /* Set OS-specific defaults for new inodes */
......
...@@ -51,7 +51,7 @@ static void jffs2_i_init_once(void * foo, kmem_cache_t * cachep, unsigned long f ...@@ -51,7 +51,7 @@ static void jffs2_i_init_once(void * foo, kmem_cache_t * cachep, unsigned long f
if ((flags & (SLAB_CTOR_VERIFY|SLAB_CTOR_CONSTRUCTOR)) == if ((flags & (SLAB_CTOR_VERIFY|SLAB_CTOR_CONSTRUCTOR)) ==
SLAB_CTOR_CONSTRUCTOR) { SLAB_CTOR_CONSTRUCTOR) {
init_MUTEX_LOCKED(&ei->sem); init_MUTEX(&ei->sem);
inode_init_once(&ei->vfs_inode); inode_init_once(&ei->vfs_inode);
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment