From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.suse.de ([195.135.220.2] helo=mx1.suse.de) by bombadil.infradead.org with esmtps (Exim 4.68 #1 (Red Hat Linux)) id 1JqtUt-0002l5-VU for linux-mtd@lists.infradead.org; Tue, 29 Apr 2008 17:20:08 +0000 Date: Tue, 29 Apr 2008 10:17:57 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Subject: [03/37] JFFS2: Fix free space leak with in-band cleanmarkers Message-ID: <20080429171757.GD14724@suse.de> References: <20080429171222.073929148@mini.kroah.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline; filename="jffs2-fix-free-space-leak-with-in-band-cleanmarkers.patch" In-Reply-To: <20080429171730.GA14724@suse.de> Cc: Martin Creutziger , Theodore Ts'o , Zwane Mwaikambo , Damir Shayhutdinov , Justin Forbes , Domenico Andreoli , Chris Wedgwood , Randy Dunlap , Michael Krufky , Chuck Ebbert , Dave Jones , linux-mtd , Chuck Wolber , akpm@linux-foundation.org, torvalds@linux-foundation.org, David Woodhouse , alan@lxorguk.ukuu.org.uk List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , 2.6.25-stable review patch. If anyone has any objections, please let us know. ------------------ From: David Woodhouse We were accounting for the cleanmarker by calling jffs2_link_node_ref() (without locking!), which adjusted both superblock and per-eraseblock accounting, subtracting the size of the cleanmarker from {jeb,c}->free_size and adding it to {jeb,c}->used_size. But only _then_ were we adding the size of the newly-erased block back to the superblock counts, and we were adding each of jeb->{free,used}_size to the corresponding superblock counts. Thus, the size of the cleanmarker was effectively subtracted from the superblock's free_size _twice_. Fix this, by always adding a full eraseblock size to c->free_size when we've erased a block. And call jffs2_link_node_ref() under the proper lock, while we're at it. Thanks to Alexander Yurchenko and/or Damir Shayhutdinov for (almost) pinpointing the problem. [Backport of commit 014b164e1392a166fe96e003d2f0e7ad2e2a0bb7] Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman --- fs/jffs2/erase.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) --- a/fs/jffs2/erase.c +++ b/fs/jffs2/erase.c @@ -419,9 +419,6 @@ static void jffs2_mark_erased_block(stru if (jffs2_write_nand_cleanmarker(c, jeb)) goto filebad; } - - /* Everything else got zeroed before the erase */ - jeb->free_size = c->sector_size; } else { struct kvec vecs[1]; @@ -449,18 +446,19 @@ static void jffs2_mark_erased_block(stru goto filebad; } - - /* Everything else got zeroed before the erase */ - jeb->free_size = c->sector_size; - /* FIXME Special case for cleanmarker in empty block */ - jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL); } + /* Everything else got zeroed before the erase */ + jeb->free_size = c->sector_size; down(&c->erase_free_sem); spin_lock(&c->erase_completion_lock); + c->erasing_size -= c->sector_size; - c->free_size += jeb->free_size; - c->used_size += jeb->used_size; + c->free_size += c->sector_size; + + /* Account for cleanmarker now, if it's in-band */ + if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c)) + jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL); jffs2_dbg_acct_sanity_check_nolock(c,jeb); jffs2_dbg_acct_paranoia_check_nolock(c, jeb); --