[03/37] JFFS2: Fix free space leak with in-band cleanmarkers

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
From: Greg KH
Date: Tuesday, April 29, 2008 - 10:17 am

2.6.25-stable review patch.  If anyone has any objections, please let us
know.

------------------
From: David Woodhouse <dwmw2@infradead.org>

We were accounting for the cleanmarker by calling jffs2_link_node_ref()
(without locking!), which adjusted both superblock and per-eraseblock
accounting, subtracting the size of the cleanmarker from {jeb,c}->free_size
and adding it to {jeb,c}->used_size.

But only _then_ were we adding the size of the newly-erased block back
to the superblock counts, and we were adding each of jeb->{free,used}_size
to the corresponding superblock counts. Thus, the size of the cleanmarker
was effectively subtracted from the superblock's free_size _twice_.

Fix this, by always adding a full eraseblock size to c->free_size when
we've erased a block. And call jffs2_link_node_ref() under the proper
lock, while we're at it.

Thanks to Alexander Yurchenko and/or Damir Shayhutdinov for (almost)
pinpointing the problem.

[Backport of commit 014b164e1392a166fe96e003d2f0e7ad2e2a0bb7]

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 fs/jffs2/erase.c |   18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

--- a/fs/jffs2/erase.c
+++ b/fs/jffs2/erase.c
@@ -419,9 +419,6 @@ static void jffs2_mark_erased_block(stru
 			if (jffs2_write_nand_cleanmarker(c, jeb))
 				goto filebad;
 		}
-
-		/* Everything else got zeroed before the erase */
-		jeb->free_size = c->sector_size;
 	} else {
 
 		struct kvec vecs[1];
@@ -449,18 +446,19 @@ static void jffs2_mark_erased_block(stru
 
 			goto filebad;
 		}
-
-		/* Everything else got zeroed before the erase */
-		jeb->free_size = c->sector_size;
-		/* FIXME Special case for cleanmarker in empty block */
-		jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
 	}
+	/* Everything else got zeroed before the erase */
+	jeb->free_size = c->sector_size;
 
 	down(&c->erase_free_sem);
 	spin_lock(&c->erase_completion_lock);
+
 	c->erasing_size -= c->sector_size;
-	c->free_size += jeb->free_size;
-	c->used_size += jeb->used_size;
+	c->free_size += c->sector_size;
+
+	/* Account for cleanmarker now, if it's in-band */
+	if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c))
+		jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
 
 	jffs2_dbg_acct_sanity_check_nolock(c,jeb);
 	jffs2_dbg_acct_paranoia_check_nolock(c, jeb);

-- 
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
[00/37] 2.6.25-stable review, Greg KH, (Tue Apr 29, 10:17 am)
[03/37] JFFS2: Fix free space leak with in-band cleanmarkers, Greg KH, (Tue Apr 29, 10:17 am)
[04/37] tg3: 5701 DMA corruption fix, Greg KH, (Tue Apr 29, 10:18 am)
[07/37] RTNETLINK: Fix bogus ASSERT_RTNL warning, Greg KH, (Tue Apr 29, 10:18 am)
[11/37] USB: OHCI: fix bug in controller resume, Greg KH, (Tue Apr 29, 10:18 am)
[14/37] RDMA/nes: Free IRQ before killing tasklet, Greg KH, (Tue Apr 29, 10:18 am)
[15/37] V4L: Fix VIDIOCGAP corruption in ivtv, Greg KH, (Tue Apr 29, 10:18 am)
[17/37] V4L: cx88: enable radio GPIO correctly, Greg KH, (Tue Apr 29, 10:18 am)
[22/37] ssb: Fix all-ones boardflags, Greg KH, (Tue Apr 29, 10:18 am)
[24/37] b43: Add more btcoexist workarounds, Greg KH, (Tue Apr 29, 10:18 am)
[25/37] b43: Workaround DMA quirks, Greg KH, (Tue Apr 29, 10:18 am)
[29/37] rtc-pcf8583 build fix, Greg KH, (Tue Apr 29, 10:19 am)
[35/37] alpha: unbreak OSF/1 (a.out) binaries, Greg KH, (Tue Apr 29, 10:19 am)
Re: [00/37] 2.6.25-stable review, Andre Noll, (Wed Apr 30, 12:58 am)
Re: [stable] [00/37] 2.6.25-stable review, Chris Wright, (Wed Apr 30, 5:25 pm)