[PATCH]: initialize parts of udf inode earlier in create

[Eric Sandeen]

I saw an oops down this path when trying to create a new file on a UDF 
filesystem which was internally marked as readonly, but mounted rw:

udf_create
       udf_new_inode
               new_inode
                       alloc_inode
                       	udf_alloc_inode
               udf_new_block
                       returns EIO due to readonlyness
               iput (on error)
                       udf_put_inode
                               udf_discard_prealloc
                                       udf_next_aext
                                               udf_current_aext
                                                       udf_get_fileshortad
                                                               OOPS

the udf_discard_prealloc() path was examining uninitialized fields of the 
udf inode.

udf_discard_prealloc() already has this code to short-circuit the discard 
path if no extents are preallocated:

       if (UDF_I_ALLOCTYPE(inode) == ICBTAG_FLAG_AD_IN_ICB ||
               inode->i_size == UDF_I_LENEXTENTS(inode))
       {
               return;
       }

so if we initialize UDF_I_LENEXTENTS(inode) = 0 earlier in udf_new_inode, we
won't try to free the (not) preallocated blocks, since this will match
the i_size = 0 set when the inode was initialized.

Thanks,

-Eric

Signed-off-by: Eric Sandeen <sandeen@xxxxxxxxxxx>

Index: linux-2.6.17/fs/udf/ialloc.c
===================================================================
--- linux-2.6.17.orig/fs/udf/ialloc.c
+++ linux-2.6.17/fs/udf/ialloc.c
@@ -75,6 +75,12 @@ struct inode * udf_new_inode (struct ino
	}
	*err = -ENOSPC;

+	UDF_I_UNIQUE(inode) = 0;
+	UDF_I_LENEXTENTS(inode) = 0;
+	UDF_I_NEXT_ALLOC_BLOCK(inode) = 0;
+	UDF_I_NEXT_ALLOC_GOAL(inode) = 0;
+	UDF_I_STRAT4096(inode) = 0;
+
	block = udf_new_block(dir->i_sb, NULL, UDF_I_LOCATION(dir).partitionReferenceNum,
		start, err);
	if (*err)
@@ -84,11 +90,6 @@ struct inode * udf_new_inode (struct ino
	}

	mutex_lock(&sbi->s_alloc_mutex);
-	UDF_I_UNIQUE(inode) = 0;
-	UDF_I_LENEXTENTS(inode) = 0;
-	UDF_I_NEXT_ALLOC_BLOCK(inode) = 0;
-	UDF_I_NEXT_ALLOC_GOAL(inode) = 0;
-	UDF_I_STRAT4096(inode) = 0;
	if (UDF_SB_LVIDBH(sb))
	{
		struct logicalVolHeaderDesc *lvhd;


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/