mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-19 10:44:14 +08:00
412a19b64a
On failure, v9fs_session_init() returns with the v9fs_session_info
struct partially initialized and expects the caller to invoke
v9fs_session_close() to clean it up; however, it doesn't track whether
the bdi is initialized or not and curiously invokes bdi_destroy() in
both vfs_session_init() failure path too.
A. If v9fs_session_init() fails before the bdi is initialized, the
follow-up v9fs_session_close() will invoke bdi_destroy() on an
uninitialized bdi.
B. If v9fs_session_init() fails after the bdi is initialized,
bdi_destroy() will be called twice on the same bdi - once in the
failure path of v9fs_session_init() and then by
v9fs_session_close().
A is broken no matter what. B used to be okay because bdi_destroy()
allowed being invoked multiple times on the same bdi, which BTW was
broken in its own way - if bdi_destroy() was invoked on an initialiezd
but !registered bdi, it'd fail to free percpu counters. Since
|
||
|---|---|---|
| .. | ||
| acl.c | ||
| acl.h | ||
| cache.c | ||
| cache.h | ||
| fid.c | ||
| fid.h | ||
| Kconfig | ||
| Makefile | ||
| v9fs_vfs.h | ||
| v9fs.c | ||
| v9fs.h | ||
| vfs_addr.c | ||
| vfs_dentry.c | ||
| vfs_dir.c | ||
| vfs_file.c | ||
| vfs_inode_dotl.c | ||
| vfs_inode.c | ||
| vfs_super.c | ||
| xattr_security.c | ||
| xattr_trusted.c | ||
| xattr_user.c | ||
| xattr.c | ||
| xattr.h | ||