linux-kernel - [GIT PULL] reiserfs fix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Wed, 31 Mar 2010 01:06:49 +0200
From:	Frederic Weisbecker <fweisbec@...il.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Thomas Siedentopf <thomas.siedentopf@...ell.com>,
	Jeff Mahoney <jeffm@...e.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	"2 . 6 . 33 . x" <stable@...nel.org>
Subject: [GIT PULL] reiserfs fix

Linus,

Please pull the reiserfs/kill-bkl branch that can be found at:

git://git.kernel.org/pub/scm/linux/kernel/git/frederic/random-tracing.git
	reiserfs/kill-bkl

Thanks,
	Frederic
---

Jeff Mahoney (1):
      reiserfs: Fix locking BUG during mount failure


 fs/reiserfs/super.c |   10 ++++------
 1 files changed, 4 insertions(+), 6 deletions(-)

---
commit b7b7fa43103a9fb30dbcc60cbd5161fdfc25f904
Author: Jeff Mahoney <jeffm@...freymahoney.com>
Date:   Mon Mar 29 15:12:39 2010 -0400

    reiserfs: Fix locking BUG during mount failure
    
    Commit 8ebc423238341b52912c7295b045a32477b33f09 (reiserfs: kill-the-BKL)
    introduced a bug in the mount failure case.
    
    The error label releases the lock before calling journal_release_error,
    but it requires that the lock be held. do_journal_release unlocks and
    retakes it. When it releases it without it held, we trigger a BUG().
    
    The error_alloc label skips the unlock since the lock isn't held yet
    but none of the other conditions that are clean up exist yet either.
    
    This patch returns immediately after the kzalloc failure and moves
    the reiserfs_write_unlock after the journal_release_error call.
    
    This was reported in https://bugzilla.novell.com/show_bug.cgi?id=591807
    
    Reported-by:  Thomas Siedentopf <thomas.siedentopf@...ell.com>
    Signed-off-by: Jeff Mahoney <jeffm@...e.com>
    Cc: Thomas Siedentopf <thomas.siedentopf@...ell.com>
    Cc: Andrew Morton <akpm@...ux-foundation.org>
    Cc: 2.6.33.x <stable@...nel.org>
    Signed-off-by: Frederic Weisbecker <fweisbec@...il.com>

diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 04bf5d7..ab19051 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1618,10 +1618,8 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
 	save_mount_options(s, data);
 
 	sbi = kzalloc(sizeof(struct reiserfs_sb_info), GFP_KERNEL);
-	if (!sbi) {
-		errval = -ENOMEM;
-		goto error_alloc;
-	}
+	if (!sbi)
+		return -ENOMEM;
 	s->s_fs_info = sbi;
 	/* Set default values for options: non-aggressive tails, RO on errors */
 	REISERFS_SB(s)->s_mount_opt |= (1 << REISERFS_SMALLTAIL);
@@ -1878,12 +1876,12 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
 	return (0);
 
 error:
-	reiserfs_write_unlock(s);
-error_alloc:
 	if (jinit_done) {	/* kill the commit thread, free journal ram */
 		journal_release_error(NULL, s);
 	}
 
+	reiserfs_write_unlock(s);
+
 	reiserfs_free_bitmap_cache(s);
 	if (SB_BUFFER_WITH_SB(s))
 		brelse(SB_BUFFER_WITH_SB(s));
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/