Commit 300b072d authored by Shaurya Rane's avatar Shaurya Rane Committed by Dave Kleikamp
Browse files

jfs: fix uninitialized waitqueue in transaction manager 



The transaction manager initialization in txInit() was not properly
initializing TxBlock[0].waitor waitqueue, causing a crash when
txEnd(0) is called on read-only filesystems.

When a filesystem is mounted read-only, txBegin() returns tid=0 to
indicate no transaction. However, txEnd(0) still gets called and
tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
waitqueue was never initialized because the initialization loop
started at index 1 instead of 0.

This causes a 'non-static key' lockdep warning and system crash:
  INFO: trying to register non-static key in txEnd

Fix by ensuring all transaction blocks including TxBlock[0] have
their waitqueues properly initialized during txInit().

Reported-by: default avatar <syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com>

Signed-off-by: default avatarShaurya Rane <ssrane_b23@ee.vjti.ac.in>
Signed-off-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
parent 7a5aa54f

fs/jfs/jfs_txnmgr.c

+5 −4
Original line number Diff line number Diff line
@@ -272,14 +272,15 @@ int txInit(void) 
	if (TxBlock == NULL)

		return -ENOMEM;



	for (k = 1; k < nTxBlock - 1; k++) {

		TxBlock[k].next = k + 1;

	for (k = 0; k < nTxBlock; k++) {

		init_waitqueue_head(&TxBlock[k].gcwait);

		init_waitqueue_head(&TxBlock[k].waitor);

	}



	for (k = 1; k < nTxBlock - 1; k++) {

		TxBlock[k].next = k + 1;

	}

	TxBlock[k].next = 0;

	init_waitqueue_head(&TxBlock[k].gcwait);

	init_waitqueue_head(&TxBlock[k].waitor);



	TxAnchor.freetid = 1;

	init_waitqueue_head(&TxAnchor.freewait);