| Message ID | 1386348692-26122-1-git-send-email-dsterba@suse.cz (mailing list archive) |
|---|---|
| State | Accepted, archived |
| Headers | show |
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index d237af8..c10aabf 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -2117,7 +2117,7 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file, err = mutex_lock_killable_nested(&dir->i_mutex, I_MUTEX_PARENT); if (err == -EINTR) - goto out; + goto out_drop_write; dentry = lookup_one_len(vol_args->name, parent, namelen); if (IS_ERR(dentry)) { err = PTR_ERR(dentry); @@ -2280,6 +2280,7 @@ out_dput: dput(dentry); out_unlock_dir: mutex_unlock(&dir->i_mutex); +out_drop_write: mnt_drop_write_file(file); out: kfree(vol_args);
If btrfs_ioctl_snap_destroy blocks on the mutex and the process is killed, mnt_write count is unbalanced and leads to unmountable filesystem. CC: stable@vger.kernel.org Signed-off-by: David Sterba <dsterba@suse.cz> --- fs/btrfs/ioctl.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)