Attachment #219541 for bug #378095

View | Details | Raw Unified | Return to bug 378095
Collapse All | Expand All




__discard_prealloc() calls list_del on ei->i_prealloc_list regardless of
the state of ei->i_prealloc_count. The rest of the action in that function
is safe regardless of if the list is empty or not.
If the list hasn't been used, then i_prealloc_list will be just initialized.
If it has, and use_preallocated_list_if_available() has been called, and
the prealloc list has been depleted, then the list entry will be poisoned.
This patch uses list_del_init so the list_head is initialized and we don't
oops on the poisoned value.
--
fs/reiserfs/bitmap.c |   11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
++ b/fs/reiserfs/bitmap.c

					      int amount_needed)
{
	struct inode *inode = hint->inode;
	struct reiserfs_inode_info *ei = REISERFS_I(inode);

	if (ei->i_prealloc_count > 0) {
		while (amount_needed) {

			*new_blocknrs++ = ei->i_prealloc_block++;
			ei->i_prealloc_count--;

			amount_needed--;

			if (ei->i_prealloc_count <= 0) {
				list_del_init(&ei->i_prealloc_list);
				break;
			}
		}

Return to bug 378095

Line Link Here

(-)file_not_specified_in_diff (-7 / +7 lines)
	__discard_prealloc() calls list_del on ei->i_prealloc_list regardless of		__discard_prealloc() calls list_del on ei->i_prealloc_list regardless of
1	the state of ei->i_prealloc_count. The rest of the action in that function	1	the state of ei->i_prealloc_count. The rest of the action in that function
2	is safe regardless of if the list is empty or not.	2	is safe regardless of if the list is empty or not.
3	If the list hasn't been used, then i_prealloc_list will be just initialized.	3	If the list hasn't been used, then i_prealloc_list will be just initialized.
4	If it has, and use_preallocated_list_if_available() has been called, and	4	If it has, and use_preallocated_list_if_available() has been called, and
5	the prealloc list has been depleted, then the list entry will be poisoned.	5	the prealloc list has been depleted, then the list entry will be poisoned.
6	This patch uses list_del_init so the list_head is initialized and we don't	6	This patch uses list_del_init so the list_head is initialized and we don't
7	oops on the poisoned value.	7	oops on the poisoned value.
8	--
9	fs/reiserfs/bitmap.c \| 11 ++++++-----	8	fs/reiserfs/bitmap.c \| 11 ++++++-----
10	1 file changed, 6 insertions(+), 5 deletions(-)	9	1 file changed, 6 insertions(+), 5 deletions(-)
11	-- a/fs/reiserfs/bitmap.c	10	++ b/fs/reiserfs/bitmap.c
Lines 1139-1155 static int use_preallocated_list_if_avai Link Here
1139	int amount_needed)	1139	int amount_needed)
1140	{	1140	{
1141	struct inode *inode = hint->inode;	1141	struct inode *inode = hint->inode;
		1142	struct reiserfs_inode_info *ei = REISERFS_I(inode);
1142		1143
1143	if (REISERFS_I(inode)->i_prealloc_count > 0) {	1144	if (ei->i_prealloc_count > 0) {
1144	while (amount_needed) {	1145	while (amount_needed) {
1145		1146
1146	*new_blocknrs++ = REISERFS_I(inode)->i_prealloc_block++;	1147	*new_blocknrs++ = ei->i_prealloc_block++;
1147	REISERFS_I(inode)->i_prealloc_count--;	1148	ei->i_prealloc_count--;
1148		1149
1149	amount_needed--;	1150	amount_needed--;
1150		1151
1151	if (REISERFS_I(inode)->i_prealloc_count <= 0) {	1152	if (ei->i_prealloc_count <= 0) {
1152	list_del(&REISERFS_I(inode)->i_prealloc_list);	1153	list_del_init(&ei->i_prealloc_list);
1153	break;	1154	break;
1154	}	1155	}
1155	}	1156	}