summaryrefslogtreecommitdiff
path: root/fs/jfs
diff options
context:
space:
mode:
Diffstat (limited to 'fs/jfs')
-rw-r--r--fs/jfs/jfs_dmap.c114
-rw-r--r--fs/jfs/jfs_dtree.c192
-rw-r--r--fs/jfs/jfs_dtree.h4
-rw-r--r--fs/jfs/jfs_imap.c4
-rw-r--r--fs/jfs/jfs_logmgr.c34
-rw-r--r--fs/jfs/jfs_logmgr.h7
-rw-r--r--fs/jfs/jfs_metapage.c3
-rw-r--r--fs/jfs/jfs_mount.c3
-rw-r--r--fs/jfs/jfs_txnmgr.c3
-rw-r--r--fs/jfs/jfs_umount.c10
10 files changed, 344 insertions, 30 deletions
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 2abe8cc02ee6..a841cf21da7d 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -134,6 +134,93 @@ static const s8 budtab[256] = {
};
/*
+ * check_dmapctl - Validate integrity of a dmapctl structure
+ * @dcp: Pointer to the dmapctl structure to check
+ *
+ * Return: true if valid, false if corrupted
+ */
+static bool check_dmapctl(struct dmapctl *dcp)
+{
+ s8 budmin = dcp->budmin;
+ u32 nleafs, l2nleafs, leafidx, height;
+ int i;
+
+ nleafs = le32_to_cpu(dcp->nleafs);
+ /* Check basic field ranges */
+ if (unlikely(nleafs > LPERCTL)) {
+ jfs_err("dmapctl: invalid nleafs %u (max %u)",
+ nleafs, LPERCTL);
+ return false;
+ }
+
+ l2nleafs = le32_to_cpu(dcp->l2nleafs);
+ if (unlikely(l2nleafs > L2LPERCTL)) {
+ jfs_err("dmapctl: invalid l2nleafs %u (max %u)",
+ l2nleafs, L2LPERCTL);
+ return false;
+ }
+
+ /* Verify nleafs matches l2nleafs (must be power of two) */
+ if (unlikely((1U << l2nleafs) != nleafs)) {
+ jfs_err("dmapctl: nleafs %u != 2^%u",
+ nleafs, l2nleafs);
+ return false;
+ }
+
+ leafidx = le32_to_cpu(dcp->leafidx);
+ /* Check leaf index matches expected position */
+ if (unlikely(leafidx != CTLLEAFIND)) {
+ jfs_err("dmapctl: invalid leafidx %u (expected %u)",
+ leafidx, CTLLEAFIND);
+ return false;
+ }
+
+ height = le32_to_cpu(dcp->height);
+ /* Check tree height is within valid range */
+ if (unlikely(height > (L2LPERCTL >> 1))) {
+ jfs_err("dmapctl: invalid height %u (max %u)",
+ height, L2LPERCTL >> 1);
+ return false;
+ }
+
+ /* Check budmin is valid (cannot be NOFREE for non-empty tree) */
+ if (budmin == NOFREE) {
+ if (unlikely(nleafs > 0)) {
+ jfs_err("dmapctl: budmin is NOFREE but nleafs %u",
+ nleafs);
+ return false;
+ }
+ } else if (unlikely(budmin < BUDMIN)) {
+ jfs_err("dmapctl: invalid budmin %d (min %d)",
+ budmin, BUDMIN);
+ return false;
+ }
+
+ /* Check leaf nodes fit within stree array */
+ if (unlikely(leafidx + nleafs > CTLTREESIZE)) {
+ jfs_err("dmapctl: leaf range exceeds stree size (end %u > %u)",
+ leafidx + nleafs, CTLTREESIZE);
+ return false;
+ }
+
+ /* Check leaf nodes have valid values */
+ for (i = leafidx; i < leafidx + nleafs; i++) {
+ s8 val = dcp->stree[i];
+
+ if (unlikely(val < NOFREE)) {
+ jfs_err("dmapctl: invalid leaf value %d at index %d",
+ val, i);
+ return false;
+ } else if (unlikely(val > 31)) {
+ jfs_err("dmapctl: leaf value %d too large at index %d", val, i);
+ return false;
+ }
+ }
+
+ return true;
+}
+
+/*
* NAME: dbMount()
*
* FUNCTION: initializate the block allocation map.
@@ -1372,7 +1459,7 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results)
dcp = (struct dmapctl *) mp->data;
budmin = dcp->budmin;
- if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) {
+ if (unlikely(!check_dmapctl(dcp))) {
jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n");
release_metapage(mp);
return -EIO;
@@ -1702,7 +1789,7 @@ static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno)
dcp = (struct dmapctl *) mp->data;
budmin = dcp->budmin;
- if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) {
+ if (unlikely(!check_dmapctl(dcp))) {
jfs_error(bmp->db_ipbmap->i_sb,
"Corrupt dmapctl page\n");
release_metapage(mp);
@@ -2485,7 +2572,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
return -EIO;
dcp = (struct dmapctl *) mp->data;
- if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) {
+ if (unlikely(!check_dmapctl(dcp))) {
jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n");
release_metapage(mp);
return -EIO;
@@ -3454,6 +3541,11 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks)
return -EIO;
}
l2dcp = (struct dmapctl *) l2mp->data;
+ if (unlikely(!check_dmapctl(l2dcp))) {
+ jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");
+ release_metapage(l2mp);
+ return -EIO;
+ }
/* compute start L1 */
k = blkno >> L2MAXL1SIZE;
@@ -3471,6 +3563,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks)
if (l1mp == NULL)
goto errout;
l1dcp = (struct dmapctl *) l1mp->data;
+ if (unlikely(!check_dmapctl(l1dcp))) {
+ jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");
+ goto errout;
+ }
/* compute start L0 */
j = (blkno & (MAXL1SIZE - 1)) >> L2MAXL0SIZE;
@@ -3484,6 +3580,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks)
goto errout;
l1dcp = (struct dmapctl *) l1mp->data;
+ if (unlikely(!check_dmapctl(l1dcp))) {
+ jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");
+ goto errout;
+ }
/* compute start L0 */
j = 0;
@@ -3503,6 +3603,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks)
if (l0mp == NULL)
goto errout;
l0dcp = (struct dmapctl *) l0mp->data;
+ if (unlikely(!check_dmapctl(l0dcp))) {
+ jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");
+ goto errout;
+ }
/* compute start dmap */
i = (blkno & (MAXL0SIZE - 1)) >>
@@ -3518,6 +3622,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks)
goto errout;
l0dcp = (struct dmapctl *) l0mp->data;
+ if (unlikely(!check_dmapctl(l0dcp))) {
+ jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");
+ goto errout;
+ }
/* compute start dmap */
i = 0;
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 9ab3f2fc61d1..ac0f79fafaca 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -115,10 +115,7 @@ struct dtsplit {
do { \
BT_GETPAGE(IP, BN, MP, dtpage_t, SIZE, P, RC, i_dtroot); \
if (!(RC)) { \
- if (((P)->header.nextindex > \
- (((BN) == 0) ? DTROOTMAXSLOT : (P)->header.maxslot)) || \
- ((BN) && (((P)->header.maxslot > DTPAGEMAXSLOT) || \
- ((P)->header.stblindex >= DTPAGEMAXSLOT)))) { \
+ if ((BN) && !check_dtpage(P)) { \
BT_PUTPAGE(MP); \
jfs_error((IP)->i_sb, \
"DT_GETPAGE: dtree page corrupt\n"); \
@@ -4297,3 +4294,190 @@ int dtModify(tid_t tid, struct inode *ip,
return 0;
}
+
+bool check_dtroot(dtroot_t *p)
+{
+ DECLARE_BITMAP(bitmap, DTROOTMAXSLOT) = {0};
+ int i;
+
+ /* freecnt cannot be negative or exceed DTROOTMAXSLOT-1
+ * (since slot[0] is occupied by the header).
+ */
+ if (unlikely(p->header.freecnt < 0 ||
+ p->header.freecnt > DTROOTMAXSLOT - 1)) {
+ jfs_err("Bad freecnt:%d in dtroot\n", p->header.freecnt);
+ return false;
+ } else if (p->header.freecnt == 0) {
+ /* No free slots: freelist must be -1 */
+ if (unlikely(p->header.freelist != -1)) {
+ jfs_err("freecnt=0, but freelist=%d in dtroot\n",
+ p->header.freelist);
+ return false;
+ }
+ } else {
+ int fsi, i;
+ /* When there are free slots, freelist must be a valid slot index in
+ * 1~DTROOTMAXSLOT-1(since slot[0] is occupied by the header).
+ */
+ if (unlikely(p->header.freelist < 1 ||
+ p->header.freelist >= DTROOTMAXSLOT)) {
+ jfs_err("Bad freelist:%d in dtroot\n", p->header.freelist);
+ return false;
+ }
+
+ /* Traverse the free list to check validity of all node indices */
+ fsi = p->header.freelist;
+ for (i = 0; i < p->header.freecnt - 1; i++) {
+ /* Check for duplicate indices in the free list */
+ if (unlikely(__test_and_set_bit(fsi, bitmap))) {
+ jfs_err("duplicate index%d in slot in dtroot\n", fsi);
+ return false;
+ }
+ fsi = p->slot[fsi].next;
+
+ /* Ensure the next slot index in the free list is valid */
+ if (unlikely(fsi < 1 || fsi >= DTROOTMAXSLOT)) {
+ jfs_err("Bad index:%d in slot in dtroot\n", fsi);
+ return false;
+ }
+ }
+
+ /* The last node in the free list must terminate with next = -1 */
+ if (unlikely(p->slot[fsi].next != -1)) {
+ jfs_err("Bad next:%d of the last slot in dtroot\n",
+ p->slot[fsi].next);
+ return false;
+ }
+ }
+
+ /* Validate nextindex (next free entry index in stbl)
+ * stbl array has size 8 (indices 0~7).
+ * It may get set to 8 when the last free slot has been filled.
+ */
+ if (unlikely(p->header.nextindex > ARRAY_SIZE(p->header.stbl))) {
+ jfs_err("Bad nextindex:%d in dtroot\n", p->header.nextindex);
+ return false;
+ }
+
+ /* Validate index validity of stbl array (8 elements)
+ * Each entry in stbl is a slot index, with valid range: -1 (invalid)
+ * or 0~8 (slot[0]~slot[8])
+ */
+ for (i = 0; i < p->header.nextindex; i++) {
+ int idx = p->header.stbl[i];
+
+ if (unlikely(idx < 0 || idx >= 9)) {
+ jfs_err("Bad index:%d of stbl[%d] in dtroot\n", idx, i);
+ return false; /* stbl entry points out of slot array range */
+ }
+
+ /* Check for duplicate valid indices (skip check for idx=0) */
+ if (unlikely(idx && __test_and_set_bit(idx, bitmap))) {
+ jfs_err("Duplicate index:%d in stbl in dtroot\n", idx);
+ return false;
+ }
+ }
+
+ return true;
+}
+
+bool check_dtpage(dtpage_t *p)
+{
+ DECLARE_BITMAP(bitmap, DTPAGEMAXSLOT) = {0};
+ const int stblsize = ((PSIZE >> L2DTSLOTSIZE) + 31) >> L2DTSLOTSIZE;
+ int i;
+
+ /* Validate maxslot (maximum number of slots in the page)
+ * dtpage_t slot array is defined to hold up to DTPAGEMAXSLOT (128) slots
+ */
+ if (unlikely(p->header.maxslot != DTPAGEMAXSLOT)) {
+ jfs_err("Bad maxslot:%d in dtpage (expected %d)\n",
+ p->header.maxslot, DTPAGEMAXSLOT);
+ return false;
+ }
+
+ /* freecnt cannot be negative or exceed DTPAGEMAXSLOT-1
+ * (since slot[0] is occupied by the header).
+ */
+ if (unlikely(p->header.freecnt < 0 ||
+ p->header.freecnt > DTPAGEMAXSLOT - 1)) {
+ jfs_err("Bad freecnt:%d in dtpage\n", p->header.freecnt);
+ return false;
+ } else if (p->header.freecnt == 0) {
+ /* No free slots: freelist must be -1 */
+ if (unlikely(p->header.freelist != -1)) {
+ jfs_err("freecnt=0 but freelist=%d in dtpage\n",
+ p->header.freelist);
+ return false;
+ }
+ } else {
+ int fsi;
+
+ if (unlikely(p->header.freelist < 1)) {
+ jfs_err("Bad freelist:%d in dtpage\n", p->header.freelist);
+ return false;
+ }
+
+ /* Traverse the free list to check validity of all node indices */
+ fsi = p->header.freelist;
+ for (i = 0; i < p->header.freecnt - 1; i++) {
+ /* Check for duplicate indices in the free list */
+ if (unlikely(__test_and_set_bit(fsi, bitmap))) {
+ jfs_err("duplicate index%d in slot in dtpage\n", fsi);
+ return false;
+ }
+ fsi = p->slot[fsi].next;
+
+ /* Ensure the next slot index in the free list is valid */
+ if (unlikely(fsi < 1 || fsi >= DTPAGEMAXSLOT)) {
+ jfs_err("Bad index:%d in slot in dtpage\n", fsi);
+ return false;
+ }
+ }
+
+ /* The last node in the free list must terminate with next = -1 */
+ if (unlikely(p->slot[fsi].next != -1)) {
+ jfs_err("Bad next:%d of the last slot in dtpage\n",
+ p->slot[fsi].next);
+ return false;
+ }
+ }
+
+ /* stbl must be little then DTPAGEMAXSLOT */
+ if (unlikely(p->header.stblindex >= DTPAGEMAXSLOT - stblsize)) {
+ jfs_err("Bad stblindex:%d in dtpage (stbl size %d)\n",
+ p->header.stblindex, stblsize);
+ return false;
+ }
+
+ /* nextindex must be little then stblsize*32 */
+ if (unlikely(p->header.nextindex > (stblsize << L2DTSLOTSIZE))) {
+ jfs_err("Bad nextindex:%d in dtpage (stbl size %d)\n",
+ p->header.nextindex, stblsize);
+ return false;
+ }
+
+ /* Validate stbl entries
+ * Each entry is a slot index, valid range: -1 (invalid) or
+ * [0, nextindex-1] (valid data slots)
+ * (stblindex and higher slots are reserved for stbl itself)
+ */
+ for (i = 0; i < p->header.nextindex; i++) {
+ int idx = DT_GETSTBL(p)[i];
+
+ /* Check if index is out of valid data slot range */
+ if (unlikely(idx < 1 || idx >= DTPAGEMAXSLOT)) {
+ jfs_err("Bad stbl[%d] index:%d (stblindex %d) in dtpage\n",
+ i, idx, p->header.stblindex);
+ return false;
+ }
+
+ /* Check for duplicate valid indices (skip -1) */
+ if (unlikely(__test_and_set_bit(idx, bitmap))) {
+ jfs_err("Duplicate index:%d in stbl of dtpage\n", idx);
+ return false;
+ }
+ }
+
+ return true;
+}
diff --git a/fs/jfs/jfs_dtree.h b/fs/jfs/jfs_dtree.h
index 1758289647a0..dfc87b6690a9 100644
--- a/fs/jfs/jfs_dtree.h
+++ b/fs/jfs/jfs_dtree.h
@@ -253,4 +253,8 @@ extern int dtModify(tid_t tid, struct inode *ip, struct component_name * key,
ino_t * orig_ino, ino_t new_ino, int flag);
extern int jfs_readdir(struct file *file, struct dir_context *ctx);
+
+extern bool check_dtroot(dtroot_t *p);
+
+extern bool check_dtpage(dtpage_t *p);
#endif /* !_H_JFS_DTREE */
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 13ab21e66f51..b84ba4d7dfb4 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -3102,6 +3102,10 @@ static int copy_from_dinode(struct dinode * dip, struct inode *ip)
if (S_ISDIR(ip->i_mode)) {
memcpy(&jfs_ip->u.dir, &dip->u._dir, 384);
+ if (!check_dtroot(&jfs_ip->i_dtroot)) {
+ jfs_error(ip->i_sb, "Corrupt dtroot\n");
+ return -EIO;
+ }
} else if (S_ISREG(ip->i_mode) || S_ISLNK(ip->i_mode)) {
memcpy(&jfs_ip->i_xtroot, &dip->di_xtroot, 288);
} else
diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index ada00d5bc214..306165e61438 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -74,12 +74,6 @@ static struct lbuf *log_redrive_list;
static DEFINE_SPINLOCK(log_redrive_lock);
-/*
- * log read/write serialization (per log)
- */
-#define LOG_LOCK_INIT(log) mutex_init(&(log)->loglock)
-#define LOG_LOCK(log) mutex_lock(&((log)->loglock))
-#define LOG_UNLOCK(log) mutex_unlock(&((log)->loglock))
/*
@@ -204,9 +198,13 @@ static void write_special_inodes(struct jfs_log *log,
struct jfs_sb_info *sbi;
list_for_each_entry(sbi, &log->sb_list, log_list) {
- writer(sbi->ipbmap->i_mapping);
- writer(sbi->ipimap->i_mapping);
- writer(sbi->direct_inode->i_mapping);
+ /* These pointers can be NULL before list_del during umount */
+ if (sbi->ipbmap)
+ writer(sbi->ipbmap->i_mapping);
+ if (sbi->ipimap)
+ writer(sbi->ipimap->i_mapping);
+ if (sbi->direct_inode)
+ writer(sbi->direct_inode->i_mapping);
}
}
@@ -2180,8 +2178,6 @@ static void lbmIODone(struct bio *bio)
LCACHE_LOCK(flags); /* disable+lock */
- bp->l_flag |= lbmDONE;
-
if (bio->bi_status) {
bp->l_flag |= lbmERROR;
@@ -2196,12 +2192,10 @@ static void lbmIODone(struct bio *bio)
if (bp->l_flag & lbmREAD) {
bp->l_flag &= ~lbmREAD;
- LCACHE_UNLOCK(flags); /* unlock+enable */
-
/* wakeup I/O initiator */
LCACHE_WAKEUP(&bp->l_ioevent);
- return;
+ goto out;
}
/*
@@ -2225,8 +2219,7 @@ static void lbmIODone(struct bio *bio)
if (bp->l_flag & lbmDIRECT) {
LCACHE_WAKEUP(&bp->l_ioevent);
- LCACHE_UNLOCK(flags);
- return;
+ goto out;
}
tail = log->wqueue;
@@ -2278,8 +2271,6 @@ static void lbmIODone(struct bio *bio)
* leave buffer for i/o initiator to dispose
*/
if (bp->l_flag & lbmSYNC) {
- LCACHE_UNLOCK(flags); /* unlock+enable */
-
/* wakeup I/O initiator */
LCACHE_WAKEUP(&bp->l_ioevent);
}
@@ -2290,6 +2281,7 @@ static void lbmIODone(struct bio *bio)
else if (bp->l_flag & lbmGC) {
LCACHE_UNLOCK(flags);
lmPostGC(bp);
+ LCACHE_LOCK(flags); /* disable+lock */
}
/*
@@ -2302,9 +2294,11 @@ static void lbmIODone(struct bio *bio)
assert(bp->l_flag & lbmRELEASE);
assert(bp->l_flag & lbmFREE);
lbmfree(bp);
-
- LCACHE_UNLOCK(flags); /* unlock+enable */
}
+
+out:
+ bp->l_flag |= lbmDONE;
+ LCACHE_UNLOCK(flags);
}
int jfsIOWait(void *arg)
diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h
index 8b8994e48cd0..09e0ef6aecce 100644
--- a/fs/jfs/jfs_logmgr.h
+++ b/fs/jfs/jfs_logmgr.h
@@ -403,6 +403,13 @@ struct jfs_log {
};
/*
+ * log read/write serialization (per log)
+ */
+#define LOG_LOCK_INIT(log) mutex_init(&(log)->loglock)
+#define LOG_LOCK(log) mutex_lock(&((log)->loglock))
+#define LOG_UNLOCK(log) mutex_unlock(&((log)->loglock))
+
+/*
* Log flag
*/
#define log_INLINELOG 1
diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index c95804f6dc19..41fe12e641ce 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -270,6 +270,7 @@ static inline struct metapage *alloc_metapage(gfp_t gfp_mask)
mp->clsn = 0;
mp->log = NULL;
init_waitqueue_head(&mp->wait);
+ INIT_LIST_HEAD(&mp->synclist);
}
return mp;
}
@@ -379,7 +380,7 @@ static void remove_from_logsync(struct metapage *mp)
mp->lsn = 0;
mp->clsn = 0;
log->count--;
- list_del(&mp->synclist);
+ list_del_init(&mp->synclist);
}
LOGSYNC_UNLOCK(log, flags);
}
diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
index 52e6b58c5dbd..dac822f15070 100644
--- a/fs/jfs/jfs_mount.c
+++ b/fs/jfs/jfs_mount.c
@@ -378,11 +378,12 @@ static int chkSuper(struct super_block *sb)
sbi->nbperpage = PSIZE >> sbi->l2bsize;
sbi->l2nbperpage = L2PSIZE - sbi->l2bsize;
sbi->l2niperblk = sbi->l2bsize - L2DISIZE;
+ uuid_copy(&sbi->uuid, &j_sb->s_uuid);
+
if (sbi->mntflag & JFS_INLINELOG)
sbi->logpxd = j_sb->s_logpxd;
else {
sbi->logdev = new_decode_dev(le32_to_cpu(j_sb->s_logdev));
- uuid_copy(&sbi->uuid, &j_sb->s_uuid);
uuid_copy(&sbi->loguuid, &j_sb->s_loguuid);
}
sbi->fsckpxd = j_sb->s_fsckpxd;
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index c16578af3a77..083dbbb0c326 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -275,6 +275,7 @@ int txInit(void)
for (k = 0; k < nTxBlock; k++) {
init_waitqueue_head(&TxBlock[k].gcwait);
init_waitqueue_head(&TxBlock[k].waitor);
+ INIT_LIST_HEAD(&TxBlock[k].synclist);
}
for (k = 1; k < nTxBlock - 1; k++) {
@@ -974,7 +975,7 @@ static void txUnlock(struct tblock * tblk)
if (tblk->lsn) {
LOGSYNC_LOCK(log, flags);
log->count--;
- list_del(&tblk->synclist);
+ list_del_init(&tblk->synclist);
LOGSYNC_UNLOCK(log, flags);
}
}
diff --git a/fs/jfs/jfs_umount.c b/fs/jfs/jfs_umount.c
index 8ec43f53f686..18569f1eaabd 100644
--- a/fs/jfs/jfs_umount.c
+++ b/fs/jfs/jfs_umount.c
@@ -20,6 +20,7 @@
#include "jfs_superblock.h"
#include "jfs_dmap.h"
#include "jfs_imap.h"
+#include "jfs_logmgr.h"
#include "jfs_metapage.h"
#include "jfs_debug.h"
@@ -58,6 +59,12 @@ int jfs_umount(struct super_block *sb)
jfs_flush_journal(log, 2);
/*
+ * Hold log lock so write_special_inodes (lmLogSync) cannot see
+ * this sbi with a NULL inode pointer while iterating log->sb_list.
+ */
+ if (log)
+ LOG_LOCK(log);
+ /*
* close fileset inode allocation map (aka fileset inode)
*/
diUnmount(ipimap, 0);
@@ -95,6 +102,9 @@ int jfs_umount(struct super_block *sb)
*/
filemap_write_and_wait(sbi->direct_inode->i_mapping);
+ if (log)
+ LOG_UNLOCK(log);
+
/*
* ensure all file system file pages are propagated to their
* home blocks on disk (and their in-memory buffer pages are
generated by cgit v1.2.3 (git 2.0.4) at 2026-04-16 10:57:12 +0000