linux-kernel - [PATCH] jffs2: fix lock not released on error handling path in jffs2_flash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20221019075458.2072174-1-lizetao1@huawei.com>
Date:   Wed, 19 Oct 2022 15:54:58 +0800
From:   Li Zetao <lizetao1@...wei.com>
To:     <dwmw2@...radead.org>, <richard@....at>
CC:     <lizetao1@...wei.com>, <miquel.raynal@...tlin.com>,
        <kernel@...pniu.pl>, <tglx@...ncher.tec.linutronix.de>,
        <linux-mtd@...ts.infradead.org>, <linux-kernel@...r.kernel.org>
Subject: [PATCH] jffs2: fix lock not released on error handling path in jffs2_flash_writev()

When jffs2_sum_add_kvec() returns an error in jffs2_flash_writev(), the
write lock will not be released, resulting in a deadlock.

Fix it by releasing the write lock on error handling path.

Fixes: dcb0932884b8 ("[JFFS2] Simplify writebuffer handling")
Signed-off-by: Li Zetao <lizetao1@...wei.com>
---
 fs/jffs2/wbuf.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
index 4061e0ba7010..ba3e9f4ba1d8 100644
--- a/fs/jffs2/wbuf.c
+++ b/fs/jffs2/wbuf.c
@@ -903,9 +903,9 @@ int jffs2_flash_writev(struct jffs2_sb_info *c, const struct kvec *invecs,
 	*retlen = donelen;
 
 	if (jffs2_sum_active()) {
-		int res = jffs2_sum_add_kvec(c, invecs, count, (uint32_t) to);
-		if (res)
-			return res;
+		ret = jffs2_sum_add_kvec(c, invecs, count, (uint32_t) to);
+		if (ret)
+			goto outsum;
 	}
 
 	if (c->wbuf_len && ino)
@@ -930,6 +930,8 @@ int jffs2_flash_writev(struct jffs2_sb_info *c, const struct kvec *invecs,
 
 outerr:
 	*retlen = 0;
+
+outsum:
 	up_write(&c->wbuf_sem);
 	return ret;
 }
-- 
2.31.1