[PATCH] fuse: fix bitfield race

[linux-2.6] / fs / jfs / jfs_dmap.c

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 51c02bf07878bf7e1e4862e929e6027687dfa0d3..2967b73934151f2291b2d0123dacb2f125239020 100644 (file)
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -74,7 +74,7 @@
 static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
                        int nblocks);
 static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval);
-static void dbBackSplit(dmtree_t * tp, int leafno);
+static int dbBackSplit(dmtree_t * tp, int leafno);
 static int dbJoin(dmtree_t * tp, int leafno, int newval);
 static void dbAdjTree(dmtree_t * tp, int leafno, int newval);
 static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc,
@@ -302,8 +302,7 @@ int dbSync(struct inode *ipbmap)
        /*
         * write out dirty pages of bmap
         */
-       filemap_fdatawrite(ipbmap->i_mapping);
-       filemap_fdatawait(ipbmap->i_mapping);
+       filemap_write_and_wait(ipbmap->i_mapping);
 
        diWriteSpecial(ipbmap, 0);
 
@@ -2466,7 +2465,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
                 * that it is at the front of a binary buddy system.
                 */
                if (oldval == NOFREE) {
-                       dbBackSplit((dmtree_t *) dcp, leafno);
+                       rc = dbBackSplit((dmtree_t *) dcp, leafno);
+                       if (rc)
+                               return rc;
                        oldval = dcp->stree[ti];
                }
                dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval);
@@ -2626,7 +2627,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
  *
  * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit;
  */
-static void dbBackSplit(dmtree_t * tp, int leafno)
+static int dbBackSplit(dmtree_t * tp, int leafno)
 {
        int budsz, bud, w, bsz, size;
        int cursz;
@@ -2661,7 +2662,10 @@ static void dbBackSplit(dmtree_t * tp, int leafno)
                 */
                for (w = leafno, bsz = budsz;; bsz <<= 1,
                     w = (w < bud) ? w : bud) {
-                       assert(bsz < le32_to_cpu(tp->dmt_nleafs));
+                       if (bsz >= le32_to_cpu(tp->dmt_nleafs)) {
+                               jfs_err("JFS: block map error in dbBackSplit");
+                               return -EIO;
+                       }
 
                        /* determine the buddy.
                         */
@@ -2680,7 +2684,11 @@ static void dbBackSplit(dmtree_t * tp, int leafno)
                }
        }
 
-       assert(leaf[leafno] == size);
+       if (leaf[leafno] != size) {
+               jfs_err("JFS: wrong leaf value in dbBackSplit");
+               return -EIO;
+       }
+       return 0;
 }