From 2928f0d0c5ebd6c9605c0d98207a44376387c298 Mon Sep 17 00:00:00 2001 From: Adam Thomas Date: Sat, 2 Feb 2013 22:32:31 +0000 Subject: UBIFS: fix use of freed ubifs_orphan objects The last orphan in the cnext list has its cnext set to NULL. Because of that, ubifs_delete_orphan assumes that it is not on the cnext list and frees it immediately instead of adding it to the dnext list. The freed orphan is later modified by write_orph_node. This can cause various inconsistencies including directory entries that cannot be removed and this error: UBIFS error (pid 20685): layout_cnodes: LPT out of space at LEB 14:129009 needing 17, done_ltab 1, done_lsave 1 This is a regression introduced by "7074e5eb UBIFS: remove invalid reference to list iterator variable". This change adds an explicit flag to ubifs_orphan indicating whether it is pending commit. Signed-off-by: Adam Thomas Reviewed-by: Adrian Hunter Cc: stable@vger.kernel.org # v3.6+ Signed-off-by: Artem Bityutskiy --- fs/ubifs/ubifs.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'fs/ubifs/ubifs.h') diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h index d133c276fe05..c16fff7271d3 100644 --- a/fs/ubifs/ubifs.h +++ b/fs/ubifs/ubifs.h @@ -904,6 +904,7 @@ struct ubifs_budget_req { * @dnext: next orphan to delete * @inum: inode number * @new: %1 => added since the last commit, otherwise %0 + * @cmt: %1 => commit pending, otherwise %0 */ struct ubifs_orphan { struct rb_node rb; @@ -912,7 +913,8 @@ struct ubifs_orphan { struct ubifs_orphan *cnext; struct ubifs_orphan *dnext; ino_t inum; - int new; + unsigned new:1; + unsigned cmt:1; }; /** -- cgit v1.2.3