[PATCH] one-liner fix for bforget() honoring BH_Protected; was: Re: Patch (repost): cramfs memory corruption fix

From: "David L. Parsley" <parsley@linuxjedi.org>
To: Linus Torvalds <torvalds@transmeta.com>
Cc: "Adam J. Richter" <adam@yggdrasil.com>,
	parsley@roanoke.edu, linux-kernel@vger.kernel.org
Subject: [PATCH] one-liner fix for bforget() honoring BH_Protected; was: Re:  Patch (repost): cramfs memory corruption fix
Date: Wed, 10 Jan 2001 18:30:50 -0500	[thread overview]
Message-ID: <3A5CF0AA.1AC1E753@linuxjedi.org> (raw)
In-Reply-To: <Pine.LNX.4.10.10101071938540.28661-100000@penguin.transmeta.com>

[-- Attachment #1: Type: text/plain, Size: 986 bytes --]

Linus Torvalds wrote:
> 
> On Sat, 6 Jan 2001, Adam J. Richter wrote:
> >
> >       This sounds like a bug that I posted a fix for a long time ago.
> > cramfs calls bforget on the superblock area, destroying that block of
> > the ramdisk, even when the ramdisk does not contain a cramfs file system.
> > Normally, bforget is called on block that really can be trashed,
> > such as blocks release by truncate or unlink.
> 
> I'd really prefer just not letting bforget() touch BH_Protected buffers.
> bforget() is also used by other things than unlink/truncate: it's used by
> various partition codes etc, and it's used by the raid logic.

Yup, I backed out Adam's one-liner in favor of the attached one-liner. 
Tested on 2.4.0, but should patch cleanly to just about anything. ;-)

BTW Linus - you were of course right on the cramfs wanting 4096
blocksize... but without this fix, that doesn't matter much. ;-)

regards,
	David

-- 
David L. Parsley
Network Administrator
Roanoke College

[-- Attachment #2: bforgetfix.diff --]
[-- Type: text/plain, Size: 684 bytes --]

--- linux.linus/fs/buffer.c	Wed Jan  3 23:45:26 2001
+++ linux/fs/buffer.c	Wed Jan 10 15:49:36 2001
@@ -1145,13 +1145,15 @@
  * free list if it can.. We can NOT free the buffer if:
  *  - there are other users of it
  *  - it is locked and thus can have active IO
+ *  - it is marked BH_Protected
  */
 void __bforget(struct buffer_head * buf)
 {
 	/* grab the lru lock here to block bdflush. */
 	spin_lock(&lru_list_lock);
 	write_lock(&hash_table_lock);
-	if (!atomic_dec_and_test(&buf->b_count) || buffer_locked(buf))
+	if (!atomic_dec_and_test(&buf->b_count) || buffer_locked(buf) || 
+	    buffer_protected(buf))
 		goto in_use;
 	__hash_unlink(buf);
 	remove_inode_queue(buf);
