diff options
| author | Dave Kleikamp <shaggy@linux.vnet.ibm.com> | 2009-02-06 14:59:26 -0600 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-02-06 13:34:22 -0800 |
| commit | d4cf109f05ff04c6f5065c3e14165ef01a57dd53 (patch) | |
| tree | 898a0d6b4d8934ec4939a8572e1b78dbb9689d93 /fs | |
| parent | 6cec50838ed04a9833fb5549f698d3756bbe7e72 (diff) | |
| download | lwn-d4cf109f05ff04c6f5065c3e14165ef01a57dd53.tar.gz lwn-d4cf109f05ff04c6f5065c3e14165ef01a57dd53.zip | |
vfs: Don't call attach_nobh_buffers() with an empty list
This is a modification of a patch by Bill Pemberton <wfp5p@virginia.edu>
nobh_write_end() could call attach_nobh_buffers() with head == NULL.
This would result in a trap when attach_nobh_buffers() attempted to
access bh->b_this_page.
This can be illustrated by running the writev01 testcase from LTP on jfs.
This error was introduced by commit 5b41e74a "vfs: fix data leak in
nobh_write_end()". That patch did not take into account that if
PageMappedToDisk() is true upon entry to nobh_write_begin(), then no
buffers will be allocated for the page. In that case, we won't have to
worry about a failed write leaving unitialized data in the page.
Of course, head != NULL implies !page_has_buffers(page), so no need to
test both.
Signed-off-by: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
Cc: Bill Pemberton <wfp5p@virginia.edu>
Cc: Dmitri Monakhov <dmonakhov@openvz.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/buffer.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/buffer.c b/fs/buffer.c index b58208f1640a..665d446b25bc 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2688,7 +2688,7 @@ int nobh_write_end(struct file *file, struct address_space *mapping, struct buffer_head *bh; BUG_ON(fsdata != NULL && page_has_buffers(page)); - if (unlikely(copied < len) && !page_has_buffers(page)) + if (unlikely(copied < len) && head) attach_nobh_buffers(page, head); if (page_has_buffers(page)) return generic_write_end(file, mapping, pos, len, |