Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=87873c86802ba7ff9d9550d06459a6e99d72c5eb
Commit:     87873c86802ba7ff9d9550d06459a6e99d72c5eb
Parent:     5e1e9ba690a2e2135a8f997242f9c46d2b8ac033
Author:     Sebastian Siewior <[EMAIL PROTECTED]>
AuthorDate: Wed Jun 6 14:03:58 2007 +1000
Committer:  Paul Mackerras <[EMAIL PROTECTED]>
CommitDate: Thu Jun 7 11:44:40 2007 +1000

    [POWERPC] spufs: Fix error handling in spufs_fill_dir()
    
    The error path in spufs_fill_dir() is broken. If d_alloc_name() or
    spufs_new_file() fails, spufs_prune_dir() is getting called. At this time
    dir->inode is not set and a NULL pointer is dereferenced by mutex_lock().
    This bugfix replaces spufs_prune_dir() with a shorter version that does
    not touch dir->inode but simply removes all children.
    
    Signed-off-by: Sebastian Siewior <[EMAIL PROTECTED]>
    Signed-off-by: Jeremy Kerr <[EMAIL PROTECTED]>
    Acked-by: Arnd Bergmann <[EMAIL PROTECTED]>
    Signed-off-by: Paul Mackerras <[EMAIL PROTECTED]>
---
 arch/powerpc/platforms/cell/spufs/inode.c |   17 +++++++++++++++--
 1 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/platforms/cell/spufs/inode.c 
b/arch/powerpc/platforms/cell/spufs/inode.c
index 0835681..9807206 100644
--- a/arch/powerpc/platforms/cell/spufs/inode.c
+++ b/arch/powerpc/platforms/cell/spufs/inode.c
@@ -177,7 +177,7 @@ static int spufs_rmdir(struct inode *parent, struct dentry 
*dir)
 static int spufs_fill_dir(struct dentry *dir, struct tree_descr *files,
                          int mode, struct spu_context *ctx)
 {
-       struct dentry *dentry;
+       struct dentry *dentry, *tmp;
        int ret;
 
        while (files->name && files->name[0]) {
@@ -193,7 +193,20 @@ static int spufs_fill_dir(struct dentry *dir, struct 
tree_descr *files,
        }
        return 0;
 out:
-       spufs_prune_dir(dir);
+       /*
+        * remove all children from dir. dir->inode is not set so don't
+        * just simply use spufs_prune_dir() and panic afterwards :)
+        * dput() looks like it will do the right thing:
+        * - dec parent's ref counter
+        * - remove child from parent's child list
+        * - free child's inode if possible
+        * - free child
+        */
+       list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) {
+               dput(dentry);
+       }
+
+       shrink_dcache_parent(dir);
        return ret;
 }
 
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to