Attachment 316823 Details for Bug 462434 – Upstream patch for this issue

[patch] Upstream patch for this issue

0001-splice-fix-bad-unlock_page-in-error-case.patch (text/plain), 1.25 KB, created by Eugene Teo (Security Response) on 2008-09-16 08:45:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eugene Teo (Security Response)

Created: 2008-09-16 08:45:20 UTC

Size: 1.25 KB

patch

obsolete

>From 6a860c979b35469e4d77da781a96bdb2ca05ae64 Mon Sep 17 00:00:00 2001
>From: Jens Axboe <jens.axboe@oracle.com>
>Date: Fri, 20 Jul 2007 15:18:12 +0200
>Subject: [PATCH] splice: fix bad unlock_page() in error case
>
>If add_to_page_cache_lru() fails, the page will not be locked. But
>splice jumps to an error path that does a page release and unlock,
>causing a BUG() in unlock_page().
>
>Fix this by adding one more label that just releases the page. This bug
>was actually triggered on EL5 by gurudas pai <gurudas.pai@oracle.com>
>using fio.
>
>Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
>Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
>---
> fs/splice.c |    5 +++--
> 1 files changed, 3 insertions(+), 2 deletions(-)
>
>diff --git a/fs/splice.c b/fs/splice.c
>index 22496d2..0a09732 100644
>--- a/fs/splice.c
>+++ b/fs/splice.c
>@@ -594,7 +594,7 @@ find_page:
> 		ret = add_to_page_cache_lru(page, mapping, index,
> 					    GFP_KERNEL);
> 		if (unlikely(ret))
>-			goto out;
>+			goto out_release;
> 	}
> 
> 	ret = mapping->a_ops->prepare_write(file, page, offset, offset+this_len);
>@@ -650,8 +650,9 @@ find_page:
> 	 */
> 	mark_page_accessed(page);
> out:
>-	page_cache_release(page);
> 	unlock_page(page);
>+out_release:
>+	page_cache_release(page);
> out_ret:
> 	return ret;
> }
>-- 
>1.5.5.1
>

Actions: View | Diff

Attachments on bug 462434: 316823