Commit f129ccc9231c95513a1227ca9da876beeb03e577
Committed by
Linus Torvalds
1 parent
4662db4461
afs: Fix oops in afs_unlink_writeback
I'm seeing the following oops when testing afs: Unable to handle kernel paging request for data at address 0x00000008 ... NIP [c0000000003393b0] .afs_unlink_writeback+0x38/0xc0 LR [c00000000033987c] .afs_put_writeback+0x98/0xec Call Trace: [c00000000345f600] [c00000000033987c] .afs_put_writeback+0x98/0xec [c00000000345f690] [c00000000033ae80] .afs_write_begin+0x6a4/0x75c [c00000000345f790] [c00000000012b77c] .generic_file_buffered_write+0x148/0x320 [c00000000345f8d0] [c00000000012e1b8] .__generic_file_aio_write+0x37c/0x3e4 [c00000000345f9d0] [c00000000012e2a8] .generic_file_aio_write+0x88/0xfc [c00000000345fa90] [c0000000003390a8] .afs_file_write+0x10c/0x178 [c00000000345fb40] [c000000000188788] .do_sync_write+0xc4/0x128 [c00000000345fcc0] [c000000000189658] .vfs_write+0xe8/0x1d8 [c00000000345fd70] [c000000000189884] .SyS_write+0x68/0xb0 [c00000000345fe30] [c000000000008564] syscall_exit+0x0/0x40 afs_write_begin hits an error and calls afs_unlink_writeback. In there we do list_del_init on an uninitialised list. The patch below initialises ->link when creating the afs_writeback struct. Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Showing 1 changed file with 1 additions and 0 deletions Side-by-side Diff
fs/afs/write.c
... | ... | @@ -140,6 +140,7 @@ |
140 | 140 | candidate->first = candidate->last = index; |
141 | 141 | candidate->offset_first = from; |
142 | 142 | candidate->to_last = to; |
143 | + INIT_LIST_HEAD(&candidate->link); | |
143 | 144 | candidate->usage = 1; |
144 | 145 | candidate->state = AFS_WBACK_PENDING; |
145 | 146 | init_waitqueue_head(&candidate->waitq); |