diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2013-02-26 14:51:14 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2013-02-26 14:51:14 -0800 |
| commit | a6590b9f01dca2d45a38b8387f59812c44f68a2f (patch) | |
| tree | cabc65bb93d92763538d04cdfba1e62eaffc8a76 /fs/ubifs/orphan.c | |
| parent | 1085db4aa68ce960f8c987a67a104ba834022fef (diff) | |
| parent | 8afd500cb52a5d00bab4525dd5a560d199f979b9 (diff) | |
| download | linux-a6590b9f01dca2d45a38b8387f59812c44f68a2f.tar.gz linux-a6590b9f01dca2d45a38b8387f59812c44f68a2f.tar.bz2 linux-a6590b9f01dca2d45a38b8387f59812c44f68a2f.zip | |
Merge tag 'upstream-3.9-rc1' of git://git.infradead.org/linux-ubifs
Pull ubifs updates from Artem Bityutskiy:
"It's been quite silent and we have only a couple of bug-fixes for the
orphans handling code plus one cosmetic change."
* tag 'upstream-3.9-rc1' of git://git.infradead.org/linux-ubifs:
UBIFS: fix double free of ubifs_orphan objects
UBIFS: fix use of freed ubifs_orphan objects
UBIFS: rename random32() to prandom_u32()
Diffstat (limited to 'fs/ubifs/orphan.c')
| -rw-r--r-- | fs/ubifs/orphan.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c index 769701ccb5c9..ba32da3fe08a 100644 --- a/fs/ubifs/orphan.c +++ b/fs/ubifs/orphan.c @@ -126,13 +126,14 @@ void ubifs_delete_orphan(struct ubifs_info *c, ino_t inum) else if (inum > o->inum) p = p->rb_right; else { - if (o->dnext) { + if (o->del) { spin_unlock(&c->orphan_lock); dbg_gen("deleted twice ino %lu", (unsigned long)inum); return; } - if (o->cnext) { + if (o->cmt) { + o->del = 1; o->dnext = c->orph_dnext; c->orph_dnext = o; spin_unlock(&c->orphan_lock); @@ -172,7 +173,9 @@ int ubifs_orphan_start_commit(struct ubifs_info *c) last = &c->orph_cnext; list_for_each_entry(orphan, &c->orph_new, new_list) { ubifs_assert(orphan->new); + ubifs_assert(!orphan->cmt); orphan->new = 0; + orphan->cmt = 1; *last = orphan; last = &orphan->cnext; } @@ -299,7 +302,9 @@ static int write_orph_node(struct ubifs_info *c, int atomic) cnext = c->orph_cnext; for (i = 0; i < cnt; i++) { orphan = cnext; + ubifs_assert(orphan->cmt); orph->inos[i] = cpu_to_le64(orphan->inum); + orphan->cmt = 0; cnext = orphan->cnext; orphan->cnext = NULL; } @@ -378,6 +383,7 @@ static int consolidate(struct ubifs_info *c) list_for_each_entry(orphan, &c->orph_list, list) { if (orphan->new) continue; + orphan->cmt = 1; *last = orphan; last = &orphan->cnext; cnt += 1; @@ -442,6 +448,7 @@ static void erase_deleted(struct ubifs_info *c) orphan = dnext; dnext = orphan->dnext; ubifs_assert(!orphan->new); + ubifs_assert(orphan->del); rb_erase(&orphan->rb, &c->orph_tree); list_del(&orphan->list); c->tot_orphans -= 1; @@ -531,6 +538,7 @@ static int insert_dead_orphan(struct ubifs_info *c, ino_t inum) rb_link_node(&orphan->rb, parent, p); rb_insert_color(&orphan->rb, &c->orph_tree); list_add_tail(&orphan->list, &c->orph_list); + orphan->del = 1; orphan->dnext = c->orph_dnext; c->orph_dnext = orphan; dbg_mnt("ino %lu, new %d, tot %d", (unsigned long)inum, |