| Message ID | 20190220102133.7878-3-houtao1@huawei.com |
|---|---|
| State | New, archived |
| Delegated to: | Richard Weinberger |
| Headers | show |
| Series | jffs2: fixes for file creation failed halfway | expand |
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c index 389ea53ea487..0bae0583106e 100644 --- a/fs/jffs2/readinode.c +++ b/fs/jffs2/readinode.c @@ -1328,6 +1328,7 @@ int jffs2_do_read_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f, case INO_STATE_CHECKING: case INO_STATE_GC: + case INO_STATE_CLEARING: /* If it's in either of these states, we need to wait for whoever's got it to finish and put it back. */
For inode that fails to be created midway, GC procedure may try to GC its dnode, and in the following case BUG() will be triggered: CPU 0 CPU 1 in jffs2_do_create() in jffs2_garbage_collect_pass() jffs2_write_dnode succeed // for dirent jffs2_reserve_space fail inum = ic->ino nlink = ic->pino_nlink (> 0) iget_failed make_bad_inode remove_inode_hash iput jffs2_evict_inode jffs2_do_clear_inode jffs2_set_inocache_state(INO_STATE_CLEARING) jffs2_gc_fetch_inode jffs2_iget // a new inode is created because // the old inode had been unhashed iget_locked jffs2_do_read_inode jffs2_get_ino_cache // assert BUG() f->inocache->state = INO_STATE_CLEARING Fix it by waiting for its state changes to INO_STATE_CHECKEDABSENT. Fixes: 67e345d17ff8 ("[JFFS2] Prevent ino cache removal for inodes in use") Cc: stable@vger.kernel.org Signed-off-by: Hou Tao <houtao1@huawei.com> --- fs/jffs2/readinode.c | 1 + 1 file changed, 1 insertion(+)