kevin/linux
1
Fork 0
Code
cc09c0dc57
linux/fs/xfs
History
Dave Chinner cc09c0dc57 [XFS] Fix double free of log tickets 
When an I/O error occurs during an intermediate commit on a rolling
transaction, xfs_trans_commit() will free the transaction structure
and the related ticket. However, the duplicate transaction that
gets used as the transaction continues still contains a pointer
to the ticket. Hence when the duplicate transaction is cancelled
and freed, we free the ticket a second time.

Add reference counting to the ticket so that we hold an extra
reference to the ticket over the transaction commit. We drop the
extra reference once we have checked that the transaction commit
did not return an error, thus avoiding a double free on commit
error.

Credit to Nick Piggin for tripping over the problem.

SGI-PV: 989741

Signed-off-by: Dave Chinner <david@fromorbit.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
2008-11-17 17:37:10 +11:00
..
linux-2.6 [XFS] Avoid using inodes that haven't been completely initialised 2008-11-10 17:13:23 +11:00
quota [XFS] Avoid using inodes that haven't been completely initialised 2008-11-10 17:13:23 +11:00
support [XFS] Show buffer address with debug hexdump on corruption 2008-10-30 17:05:58 +11:00
Kconfig
Makefile [XFS] move sync code to its own file 2008-10-30 17:06:08 +11:00
xfs_acl.c CRED: Wrap task credential accesses in the XFS filesystem 2008-10-31 15:50:04 +11:00
xfs_acl.h [XFS] kill bhv_vnode_t 2008-08-13 16:22:40 +10:00
xfs_ag.h [XFS] mark inodes for reclaim via a tag in the inode radix tree 2008-10-30 17:37:26 +11:00
xfs_alloc_btree.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_alloc_btree.h [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_alloc.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_alloc.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_arch.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_attr_leaf.c [XFS] Move xfs_attr_rolltrans to xfs_trans_roll 2008-08-13 16:05:49 +10:00
xfs_attr_leaf.h [XFS] Move xfs_attr_rolltrans to xfs_trans_roll 2008-08-13 16:05:49 +10:00
xfs_attr_sf.h [XFS] 2008-07-28 16:58:35 +10:00
xfs_attr.c [XFS] Move xfs_attr_rolltrans to xfs_trans_roll 2008-08-13 16:05:49 +10:00
xfs_attr.h [XFS] Move attr log alloc size calculator to another function. 2008-08-13 16:03:35 +10:00
xfs_bit.c [XFS] Use the generic bitops rather than implementing them ourselves. 2008-08-13 15:41:12 +10:00
xfs_bit.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_bmap_btree.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_bmap_btree.h [XFS] Move XFS_BMAP_SANITY_CHECK out of line. 2008-10-30 17:14:43 +11:00
xfs_bmap.c [XFS] Fix double free of log tickets 2008-11-17 17:37:10 +11:00
xfs_bmap.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_btree_trace.c [XFS] make btree tracing generic 2008-10-30 16:58:50 +11:00
xfs_btree_trace.h [XFS] make btree tracing generic 2008-10-30 16:58:50 +11:00
xfs_btree.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_btree.h [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_buf_item.c [XFS] Finish removing the mount pointer from the AIL API 2008-10-30 17:39:58 +11:00
xfs_buf_item.h
xfs_da_btree.c [XFS] Account for allocated blocks when expanding directories 2008-10-30 17:38:12 +11:00
xfs_da_btree.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_dfrag.c [XFS] Prevent lockdep false positives when locking two inodes. 2008-09-17 16:51:21 +10:00
xfs_dfrag.h
xfs_dinode.h [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_dir2_block.c [XFS] Return case-insensitive match for dentry cache 2008-07-28 16:58:40 +10:00
xfs_dir2_block.h
xfs_dir2_data.c [XFS] Name operation vector for hash and compare 2008-07-28 16:58:36 +10:00
xfs_dir2_data.h
xfs_dir2_leaf.c [XFS] Fix CI lookup in leaf-form directories 2008-07-28 16:59:06 +10:00
xfs_dir2_leaf.h
xfs_dir2_node.c [XFS] Fix returning case-preserved name with CI node form directories 2008-07-28 16:59:01 +10:00
xfs_dir2_node.h
xfs_dir2_sf.c [XFS] Return case-insensitive match for dentry cache 2008-07-28 16:58:40 +10:00
xfs_dir2_sf.h [XFS] Pack some shortform dir2 structures for the ARM old ABI 2008-07-28 16:58:50 +10:00
xfs_dir2_trace.c [XFS] Add op_flags field and helpers to xfs_da_args 2008-07-28 16:58:37 +10:00
xfs_dir2_trace.h
xfs_dir2.c [XFS] Account for allocated blocks when expanding directories 2008-10-30 17:38:12 +11:00
xfs_dir2.h [XFS] Return case-insensitive match for dentry cache 2008-07-28 16:58:40 +10:00
xfs_dmapi.h removed unused #include <linux/version.h>'s 2008-08-23 12:14:12 -07:00
xfs_dmops.c [XFS] kill struct xfs_mount_args 2008-10-30 17:53:24 +11:00
xfs_error.c [XFS] kill INDUCE_IO_ERROR 2008-08-13 16:17:37 +10:00
xfs_error.h [XFS] kill INDUCE_IO_ERROR 2008-08-13 16:17:37 +10:00
xfs_extfree_item.c [XFS] Finish removing the mount pointer from the AIL API 2008-10-30 17:39:58 +11:00
xfs_extfree_item.h
xfs_filestream.c [XFS] Use KM_NOFS for debug trace buffers 2008-08-13 16:51:57 +10:00
xfs_filestream.h
xfs_fs.h [XFS] attrmulti cleanup 2008-07-28 16:59:09 +10:00
xfs_fsops.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_fsops.h
xfs_ialloc_btree.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_ialloc_btree.h [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_ialloc.c [XFS] implement generic xfs_btree_get_rec 2008-10-30 16:58:11 +11:00
xfs_ialloc.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_iget.c [XFS] Fix race when looking up reclaimable inodes 2008-10-30 18:32:43 +11:00
xfs_imap.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_inode_item.c [XFS] Finish removing the mount pointer from the AIL API 2008-10-30 17:39:58 +11:00
xfs_inode_item.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_inode.c [XFS] Fix double free of log tickets 2008-11-17 17:37:10 +11:00
xfs_inode.h [XFS] free partially initialized inodes using destroy_inode 2008-10-30 18:26:04 +11:00
xfs_inum.h
xfs_iomap.c [XFS] use minleft when allocating in xfs_bmbt_split() 2008-07-28 16:59:10 +10:00
xfs_iomap.h
xfs_itable.c [XFS] stop using xfs_itobp in xfs_bulkstat 2008-10-30 18:04:13 +11:00
xfs_itable.h
xfs_log_priv.h [XFS] Fix double free of log tickets 2008-11-17 17:37:10 +11:00
xfs_log_recover.c [XFS] XFS: Check for valid transaction headers in recovery 2008-10-30 17:40:09 +11:00
xfs_log_recover.h
xfs_log.c [XFS] Fix double free of log tickets 2008-11-17 17:37:10 +11:00
xfs_log.h [XFS] Fix double free of log tickets 2008-11-17 17:37:10 +11:00
xfs_mount.c [XFS] kill deleted inodes list 2008-10-30 17:37:49 +11:00
xfs_mount.h [XFS] kill struct xfs_mount_args 2008-10-30 17:53:24 +11:00
xfs_mru_cache.c [XFS] streamline init/exit path 2008-07-28 16:59:25 +10:00
xfs_mru_cache.h
xfs_qmops.c [XFS] kill struct xfs_mount_args 2008-10-30 17:53:24 +11:00
xfs_quota.h
xfs_refcache.h
xfs_rename.c [XFS] Don't update mtime on rename source 2008-07-28 16:59:14 +10:00
xfs_rtalloc.c [XFS] Use the generic bitops rather than implementing them ourselves. 2008-08-13 15:41:12 +10:00
xfs_rtalloc.h
xfs_rw.c [XFS] replace the XFS buf iodone semaphore with a completion 2008-08-13 16:36:11 +10:00
xfs_rw.h
xfs_sb.h [XFS] XFS: ASCII case-insensitive support 2008-07-28 16:58:42 +10:00
xfs_trans_ail.c [XFS] correctly select first log item to push 2008-10-30 18:26:51 +11:00
xfs_trans_buf.c [XFS] Finish removing the mount pointer from the AIL API 2008-10-30 17:39:58 +11:00
xfs_trans_extfree.c
xfs_trans_inode.c [XFS] Remove unused arg from kmem_free() 2008-07-28 16:58:07 +10:00
xfs_trans_item.c [XFS] Add ail pointer into log items 2008-10-30 17:39:46 +11:00
xfs_trans_priv.h [XFS] Finish removing the mount pointer from the AIL API 2008-10-30 17:39:58 +11:00
xfs_trans_space.h
xfs_trans.c [XFS] Fix double free of log tickets 2008-11-17 17:37:10 +11:00
xfs_trans.h [XFS] Finish removing the mount pointer from the AIL API 2008-10-30 17:39:58 +11:00
xfs_types.h
xfs_utils.c [XFS] Fix double free of log tickets 2008-11-17 17:37:10 +11:00
xfs_utils.h [XFS] implement IHOLD/IRELE directly 2008-08-13 16:13:45 +10:00
xfs_vfsops.c [XFS] kill struct xfs_mount_args 2008-10-30 17:53:24 +11:00
xfs_vfsops.h [XFS] Move remaining quiesce code. 2008-10-30 17:16:21 +11:00
xfs_vnodeops.c [XFS] Fix double free of log tickets 2008-11-17 17:37:10 +11:00
xfs_vnodeops.h [XFS] kill sys_cred 2008-10-30 18:27:48 +11:00
xfs.h [XFS] make btree tracing generic 2008-10-30 16:55:13 +11:00