Thread (92 messages) 92 messages, 4 authors, 2012-06-17

[ 05/82] exofs: Fix CRASH on very early IO errors.

From: Ben Hutchings <hidden>
Date: 2012-06-08 05:07:34
Also in: lkml
Subsystem: filesystems (vfs and infrastructure), the rest · Maintainers: Alexander Viro, Christian Brauner, Linus Torvalds

3.2-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Boaz Harrosh <redacted>

commit 6abe4a87f7bc7978705c386dbba0ca0c7790b3ec upstream.

If at exofs_fill_super() we had an early termination
do to any error, like an IO error while reading the
super-block. We would crash inside exofs_free_sbi().

This is because sbi->oc.numdevs was set to 1, before
we actually have a device table at all.

Fix it by moving the sbi->oc.numdevs = 1 to after the
allocation of the device table.

Reported-by: Johannes Schild <redacted>

Stable: This is a bug since v3.2.0
Signed-off-by: Boaz Harrosh <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
 fs/exofs/super.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/exofs/super.c b/fs/exofs/super.c
index 735ca06..59e0849 100644
--- a/fs/exofs/super.c
+++ b/fs/exofs/super.c
@@ -745,7 +745,6 @@ static int exofs_fill_super(struct super_block *sb, void *data, int silent)
 	sbi->one_comp.obj.partition = opts->pid;
 	sbi->one_comp.obj.id = 0;
 	exofs_make_credential(sbi->one_comp.cred, &sbi->one_comp.obj);
-	sbi->oc.numdevs = 1;
 	sbi->oc.single_comp = EC_SINGLE_COMP;
 	sbi->oc.comps = &sbi->one_comp;
 
@@ -804,6 +803,7 @@ static int exofs_fill_super(struct super_block *sb, void *data, int silent)
 			goto free_sbi;
 
 		ore_comp_set_dev(&sbi->oc, 0, od);
+		sbi->oc.numdevs = 1;
 	}
 
 	__sbi_read_stats(sbi);

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help