Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
Pull ext4 fixes from Ted Ts'o:
"Two more bug fixes (including a regression) for 5.6"
* tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()
jbd2: fix data races at struct journal_head
+7
-7
+3
-3
fs/ext4/super.c
+3
-3
fs/ext4/super.c
···
2391
2391
{
2392
2392
struct ext4_sb_info *sbi = EXT4_SB(sb);
2393
2393
struct flex_groups **old_groups, **new_groups;
2394
-
int size, i;
2394
+
int size, i, j;
2395
2395
2396
2396
if (!sbi->s_log_groups_per_flex)
2397
2397
return 0;
···
2412
2412
sizeof(struct flex_groups)),
2413
2413
GFP_KERNEL);
2414
2414
if (!new_groups[i]) {
2415
-
for (i--; i >= sbi->s_flex_groups_allocated; i--)
2416
-
kvfree(new_groups[i]);
2415
+
for (j = sbi->s_flex_groups_allocated; j < i; j++)
2416
+
kvfree(new_groups[j]);
2417
2417
kvfree(new_groups);
2418
2418
ext4_msg(sb, KERN_ERR,
2419
2419
"not enough memory for %d flex groups", size);
+4
-4
fs/jbd2/transaction.c
+4
-4
fs/jbd2/transaction.c
···
1150
1150
/* For undo access buffer must have data copied */
1151
1151
if (undo && !jh->b_committed_data)
1152
1152
goto out;
1153
-
if (jh->b_transaction != handle->h_transaction &&
1154
-
jh->b_next_transaction != handle->h_transaction)
1153
+
if (READ_ONCE(jh->b_transaction) != handle->h_transaction &&
1154
+
READ_ONCE(jh->b_next_transaction) != handle->h_transaction)
1155
1155
goto out;
1156
1156
/*
1157
1157
* There are two reasons for the barrier here:
···
2569
2569
* our jh reference and thus __jbd2_journal_file_buffer() must not
2570
2570
* take a new one.
2571
2571
*/
2572
-
jh->b_transaction = jh->b_next_transaction;
2573
-
jh->b_next_transaction = NULL;
2572
+
WRITE_ONCE(jh->b_transaction, jh->b_next_transaction);
2573
+
WRITE_ONCE(jh->b_next_transaction, NULL);
2574
2574
if (buffer_freed(bh))
2575
2575
jlist = BJ_Forget;
2576
2576
else if (jh->b_modified)