Commit dc8a0843 authored by Geert Uytterhoeven's avatar Geert Uytterhoeven Committed by David Woodhouse

[JFFS2] fix race condition in jffs2_lzo_compress()

deflate_mutex protects the globals lzo_mem and lzo_compress_buf.  However,
jffs2_lzo_compress() unlocks deflate_mutex _before_ it has copied out the
compressed data from lzo_compress_buf.  Correct this by moving the mutex
unlock after the copy.

In addition, document what deflate_mutex actually protects.

Cc: stable@kernel.org
Signed-off-by: default avatarGeert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
Acked-by: default avatarRichard Purdie <rpurdie@openedhand.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
parent 467622ef
......@@ -19,7 +19,7 @@
static void *lzo_mem;
static void *lzo_compress_buf;
static DEFINE_MUTEX(deflate_mutex);
static DEFINE_MUTEX(deflate_mutex); /* for lzo_mem and lzo_compress_buf */
static void free_workspace(void)
{
......@@ -49,18 +49,21 @@ static int jffs2_lzo_compress(unsigned char *data_in, unsigned char *cpage_out,
mutex_lock(&deflate_mutex);
ret = lzo1x_1_compress(data_in, *sourcelen, lzo_compress_buf, &compress_size, lzo_mem);
mutex_unlock(&deflate_mutex);
if (ret != LZO_E_OK)
return -1;
goto fail;
if (compress_size > *dstlen)
return -1;
goto fail;
memcpy(cpage_out, lzo_compress_buf, compress_size);
*dstlen = compress_size;
mutex_unlock(&deflate_mutex);
*dstlen = compress_size;
return 0;
fail:
mutex_unlock(&deflate_mutex);
return -1;
}
static int jffs2_lzo_decompress(unsigned char *data_in, unsigned char *cpage_out,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment