Commit 4c41bd0e authored by Thomas Gleixner's avatar Thomas Gleixner Committed by David Woodhouse

[JFFS2] fix mount crash caused by removed nodes

At scan time we observed following scenario:

   node A inserted
   node B inserted
   node C inserted -> sets overlapped flag on node B

   node A is removed due to CRC failure -> overlapped flag on node B remains

   while (tn->overlapped)
   	 tn = tn_prev(tn);

   ==> crash, when tn_prev(B) is referenced.

When the ultimate node is removed at scan time and the overlapped flag
is set on the penultimate node, then nothing updates the overlapped
flag of that node. The overlapped iterators blindly expect that the
ultimate node does not have the overlapped flag set, which causes the
scan code to crash.

It would be a huge overhead to go through the node chain on node
removal and fix up the overlapped flags, so detecting such a case on
the fly in the overlapped iterators is a simpler and reliable
solution.

Cc: stable@kernel.org
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
parent efab0b5d
...@@ -220,7 +220,7 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c, ...@@ -220,7 +220,7 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
struct jffs2_tmp_dnode_info *tn) struct jffs2_tmp_dnode_info *tn)
{ {
uint32_t fn_end = tn->fn->ofs + tn->fn->size; uint32_t fn_end = tn->fn->ofs + tn->fn->size;
struct jffs2_tmp_dnode_info *this; struct jffs2_tmp_dnode_info *this, *ptn;
dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw)); dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw));
...@@ -251,11 +251,18 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c, ...@@ -251,11 +251,18 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
if (this) { if (this) {
/* If the node is coincident with another at a lower address, /* If the node is coincident with another at a lower address,
back up until the other node is found. It may be relevant */ back up until the other node is found. It may be relevant */
while (this->overlapped) while (this->overlapped) {
this = tn_prev(this); ptn = tn_prev(this);
if (!ptn) {
/* First node should never be marked overlapped */ /*
BUG_ON(!this); * We killed a node which set the overlapped
* flags during the scan. Fix it up.
*/
this->overlapped = 0;
break;
}
this = ptn;
}
dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole"); dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
} }
...@@ -360,7 +367,17 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c, ...@@ -360,7 +367,17 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
} }
if (!this->overlapped) if (!this->overlapped)
break; break;
this = tn_prev(this);
ptn = tn_prev(this);
if (!ptn) {
/*
* We killed a node which set the overlapped
* flags during the scan. Fix it up.
*/
this->overlapped = 0;
break;
}
this = ptn;
} }
} }
...@@ -456,8 +473,15 @@ static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c, ...@@ -456,8 +473,15 @@ static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c,
eat_last(&rii->tn_root, &last->rb); eat_last(&rii->tn_root, &last->rb);
ver_insert(&ver_root, last); ver_insert(&ver_root, last);
if (unlikely(last->overlapped)) if (unlikely(last->overlapped)) {
if (pen)
continue; continue;
/*
* We killed a node which set the overlapped
* flags during the scan. Fix it up.
*/
last->overlapped = 0;
}
/* Now we have a bunch of nodes in reverse version /* Now we have a bunch of nodes in reverse version
order, in the tree at ver_root. Most of the time, order, in the tree at ver_root. Most of the time,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment