Commit a87a08e3 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs 

Pull JFFS2, UBI and UBIFS updates from Richard Weinberger:
 "JFFS2:
   - Fixes for various memory issues

  UBI:
   - Fix for a race condition in cdev ioctl handler

  UBIFS:
   - Fixes for O_TMPFILE and whiteout handling

   - Fixes for various memory issues"

* tag 'for-linus-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
  ubifs: rename_whiteout: correct old_dir size computing
  jffs2: fix memory leak in jffs2_scan_medium
  jffs2: fix memory leak in jffs2_do_mount_fs
  jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
  fs/jffs2: fix comments mentioning i_mutex
  ubi: fastmap: Return error code if memory allocation fails in add_aeb()
  ubifs: Fix to add refcount once page is set private
  ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()
  ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
  ubifs: Rectify space amount budget for mkdir/tmpfile operations
  ubifs: Fix 'ui->dirty' race between do_tmpfile() and writeback work
  ubifs: Rename whiteout atomically
  ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
  ubifs: Fix wrong number of inodes locked by ui_mutex in ubifs_inode comment
  ubifs: Fix deadlock in concurrent rename whiteout and inode writeback
  ubifs: rename_whiteout: Fix double free for whiteout_ui->data
  ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
parents 3d198e42 70575727

drivers/mtd/ubi/build.c

+1 −8
Original line number Diff line number Diff line
@@ -351,9 +351,6 @@ static ssize_t dev_attribute_show(struct device *dev, 
	 * we still can use 'ubi->ubi_num'.

	 */

	ubi = container_of(dev, struct ubi_device, dev);

	ubi = ubi_get_device(ubi->ubi_num);

	if (!ubi)

		return -ENODEV;



	if (attr == &dev_eraseblock_size)

		ret = sprintf(buf, "%d\n", ubi->leb_size);
@@ -382,7 +379,6 @@ static ssize_t dev_attribute_show(struct device *dev, 
	else

		ret = -EINVAL;



	ubi_put_device(ubi);

	return ret;

}
@@ -979,9 +975,6 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, 
			goto out_detach;

	}



	/* Make device "available" before it becomes accessible via sysfs */

	ubi_devices[ubi_num] = ubi;



	err = uif_init(ubi);

	if (err)

		goto out_detach;
@@ -1026,6 +1019,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, 
	wake_up_process(ubi->bgt_thread);

	spin_unlock(&ubi->wl_lock);



	ubi_devices[ubi_num] = ubi;

	ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL);

	return ubi_num;
@@ -1034,7 +1028,6 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, 
out_uif:

	uif_close(ubi);

out_detach:

	ubi_devices[ubi_num] = NULL;

	ubi_wl_close(ubi);

	ubi_free_all_volumes(ubi);

	vfree(ubi->vtbl);

drivers/mtd/ubi/fastmap.c

+19 −9
Original line number Diff line number Diff line
@@ -468,7 +468,9 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai, 
			if (err == UBI_IO_FF_BITFLIPS)

				scrub = 1;



			add_aeb(ai, free, pnum, ec, scrub);

			ret = add_aeb(ai, free, pnum, ec, scrub);

			if (ret)

				goto out;

			continue;

		} else if (err == 0 || err == UBI_IO_BITFLIPS) {

			dbg_bld("Found non empty PEB:%i in pool", pnum);
@@ -638,8 +640,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, 
		if (fm_pos >= fm_size)

			goto fail_bad;



		add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum),

		ret = add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum),

			      be32_to_cpu(fmec->ec), 0);

		if (ret)

			goto fail;

	}



	/* read EC values from used list */
@@ -649,8 +653,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, 
		if (fm_pos >= fm_size)

			goto fail_bad;



		add_aeb(ai, &used, be32_to_cpu(fmec->pnum),

		ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum),

			      be32_to_cpu(fmec->ec), 0);

		if (ret)

			goto fail;

	}



	/* read EC values from scrub list */
@@ -660,8 +666,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, 
		if (fm_pos >= fm_size)

			goto fail_bad;



		add_aeb(ai, &used, be32_to_cpu(fmec->pnum),

		ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum),

			      be32_to_cpu(fmec->ec), 1);

		if (ret)

			goto fail;

	}



	/* read EC values from erase list */
@@ -671,8 +679,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, 
		if (fm_pos >= fm_size)

			goto fail_bad;



		add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum),

		ret = add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum),

			      be32_to_cpu(fmec->ec), 1);

		if (ret)

			goto fail;

	}



	ai->mean_ec = div_u64(ai->ec_sum, ai->ec_count);

drivers/mtd/ubi/vmt.c

+1 −7
Original line number Diff line number Diff line
@@ -56,16 +56,11 @@ static ssize_t vol_attribute_show(struct device *dev, 
{

	int ret;

	struct ubi_volume *vol = container_of(dev, struct ubi_volume, dev);

	struct ubi_device *ubi;



	ubi = ubi_get_device(vol->ubi->ubi_num);

	if (!ubi)

		return -ENODEV;

	struct ubi_device *ubi = vol->ubi;



	spin_lock(&ubi->volumes_lock);

	if (!ubi->volumes[vol->vol_id]) {

		spin_unlock(&ubi->volumes_lock);

		ubi_put_device(ubi);

		return -ENODEV;

	}

	/* Take a reference to prevent volume removal */
@@ -103,7 +98,6 @@ static ssize_t vol_attribute_show(struct device *dev, 
	vol->ref_count -= 1;

	ubi_assert(vol->ref_count >= 0);

	spin_unlock(&ubi->volumes_lock);

	ubi_put_device(ubi);

	return ret;

}

fs/jffs2/build.c

+3 −1
Original line number Diff line number Diff line
@@ -415,13 +415,15 @@ int jffs2_do_mount_fs(struct jffs2_sb_info *c) 
		jffs2_free_ino_caches(c);

		jffs2_free_raw_node_refs(c);

		ret = -EIO;

		goto out_free;

		goto out_sum_exit;

	}



	jffs2_calc_trigger_levels(c);



	return 0;



 out_sum_exit:

	jffs2_sum_exit(c);

 out_free:

	kvfree(c->blocks);

fs/jffs2/fs.c

+1 −1
Original line number Diff line number Diff line
@@ -603,8 +603,8 @@ int jffs2_do_fill_super(struct super_block *sb, struct fs_context *fc) 
	jffs2_free_ino_caches(c);

	jffs2_free_raw_node_refs(c);

	kvfree(c->blocks);

 out_inohash:

	jffs2_clear_xattr_subsystem(c);

 out_inohash:

	kfree(c->inocache_list);

 out_wbuf:

	jffs2_flash_cleanup(c);