• Ryusuke Konishi's avatar
    nilfs2: fix list corruption after ifile creation failure · af4e3631
    Ryusuke Konishi authored
    If nilfs_attach_checkpoint() gets a memory allocation failure during
    creation of ifile, it will return without removing nilfs_sb_info
    struct from ns_supers list.  When a concurrently mounted snapshot is
    unmounted or another new snapshot is mounted after that, this causes
    kernel oops as below:
    
    > BUG: unable to handle kernel NULL pointer dereference at (null)
    > IP: [<f83662ff>] nilfs_find_sbinfo+0x74/0xa4 [nilfs2]
    > *pde = 00000000
    > Oops: 0000 [#1] SMP
    <snip>
    > Call Trace:
    >  [<f835dc29>] ? nilfs_get_sb+0x165/0x532 [nilfs2]
    >  [<c1173c87>] ? ida_get_new_above+0x16d/0x187
    >  [<c109a7f8>] ? alloc_vfsmnt+0x7e/0x10a
    >  [<c1070790>] ? kstrdup+0x2c/0x40
    >  [<c1089041>] ? vfs_kern_mount+0x96/0x14e
    >  [<c108913d>] ? do_kern_mount+0x32/0xbd
    >  [<c109b331>] ? do_mount+0x642/0x6a1
    >  [<c101a415>] ? do_page_fault+0x0/0x2d1
    >  [<c1099c00>] ? copy_mount_options+0x80/0xe2
    >  [<c10705d8>] ? strndup_user+0x48/0x67
    >  [<c109b3f1>] ? sys_mount+0x61/0x90
    >  [<c10027cc>] ? sysenter_do_call+0x12/0x22
    
    This fixes the problem.
    Signed-off-by: default avatarRyusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
    Tested-by: default avatarRyusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
    Cc: stable@kernel.org
    af4e3631
super.c 32.8 KB