Bug in erase failed?

[Joakim Tjernlund]

When an erase has failed:
 Newly-erased block contained word 0x0 at offset 0x0224df6
You end up in erase.c:490
filebad:
	mutex_lock(&c->erase_free_sem);
	spin_lock(&c->erase_completion_lock);
	/* Stick it on a list (any list) so erase_failed can take it
	   right off again.  Silly, but shouldn't happen often. */
	list_move(&jeb->list, &c->erasing_list);
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^
Here is the sector moved to the erasing list.

	spin_unlock(&c->erase_completion_lock);
	mutex_unlock(&c->erase_free_sem);
	jffs2_erase_failed(c, jeb, bad_offset);
      ^^^^^^^^^^^^^^
jffs2_erase_flailed also moves a sector:
	list_move(&jeb->list, &c->bad_list);
but it is already moved so you end up moving a good sector to the bad
list. Very bad.

 Jocke