Commit 7038f1cbac899654cf0515e60dbe3e44d58271de
1 parent
b6a47fd8ff
Exists in
master
and in
4 other branches
JFS: make sure right-most xtree pages have header.next set to zero
The xtTruncate code was only doing this for leaf pages. When a file is horribly fragmented, we may truncate a file leaving an internal page with an invalid head.next field, which may cause a stale page to be referenced. Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com>
Showing 1 changed file with 9 additions and 9 deletions Side-by-side Diff
fs/jfs/jfs_xtree.c
| ... | ... | @@ -3516,17 +3516,11 @@ |
| 3516 | 3516 | /* process entries backward from last index */ |
| 3517 | 3517 | index = le16_to_cpu(p->header.nextindex) - 1; |
| 3518 | 3518 | |
| 3519 | - if (p->header.flag & BT_INTERNAL) | |
| 3520 | - goto getChild; | |
| 3521 | 3519 | |
| 3522 | - /* | |
| 3523 | - * leaf page | |
| 3520 | + /* Since this is the rightmost page at this level, and we may have | |
| 3521 | + * already freed a page that was formerly to the right, let's make | |
| 3522 | + * sure that the next pointer is zero. | |
| 3524 | 3523 | */ |
| 3525 | - | |
| 3526 | - /* Since this is the rightmost leaf, and we may have already freed | |
| 3527 | - * a page that was formerly to the right, let's make sure that the | |
| 3528 | - * next pointer is zero. | |
| 3529 | - */ | |
| 3530 | 3524 | if (p->header.next) { |
| 3531 | 3525 | if (log) |
| 3532 | 3526 | /* |
| ... | ... | @@ -3539,6 +3533,12 @@ |
| 3539 | 3533 | p->header.next = 0; |
| 3540 | 3534 | } |
| 3541 | 3535 | |
| 3536 | + if (p->header.flag & BT_INTERNAL) | |
| 3537 | + goto getChild; | |
| 3538 | + | |
| 3539 | + /* | |
| 3540 | + * leaf page | |
| 3541 | + */ | |
| 3542 | 3542 | freed = 0; |
| 3543 | 3543 | |
| 3544 | 3544 | /* does region covered by leaf page precede Teof ? */ |