Messages in this thread Patch in this message | | | Date | Fri, 13 Sep 2013 20:36:55 -0600 | From | Chuck Coffing <> | Subject | [PATCH] bad bd_fsfreeze_count in freeze_bdev |
| |
Hi,
An error path in freeze_bdev screws up the freeze count.
Consider: - call freeze_bdev with a bdev that's unmounted (stupidity or a race) - bd_fsfreeze_count is unconditionally incremented on entry - can't get the sb; error out - bd_fsfreeze_count is not decremented (oops!) - call freeze_bdev again just for obnoxiousness... - since bd_fsfreeze_count is already nonzero, sb is assumed good and deref'd
(CC me, I'm not subscribed)
diff --git a/fs/block_dev.c b/fs/block_dev.c index c3549ed..f1c5561 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -253,6 +253,7 @@ struct super_block *freeze_bdev(struct block_device *bdev) } deactivate_super(sb); out: + bdev->bd_fsfreeze_count--; sync_blockdev(bdev); mutex_unlock(&bdev->bd_fsfreeze_mutex); return sb; /* thaw_bdev releases s->s_umount */
| |