[PATCH v2 1/2] UBIFS: fix use of freed ubifs_orphan objects

[Artem Bityutskiy]

On Sat, 2013-02-02 at 22:32 +0000, Adam Thomas wrote:
> The last orphan in the cnext list has its cnext set to NULL. Because
> of that, ubifs_delete_orphan assumes that it is not on the cnext list
> and frees it immediately instead of adding it to the dnext list. The
> freed orphan is later modified by write_orph_node.
> 
> This can cause various inconsistencies including directory entries
> that cannot be removed and this error:
> 
> UBIFS error (pid 20685): layout_cnodes: LPT out of space at LEB 14:129009 needing 17, done_ltab 1, done_lsave 1
> 
> This is a regression introduced by
> "7074e5eb UBIFS: remove invalid reference to list iterator variable".
> 
> This change adds an explicit flag to ubifs_orphan indicating whether
> it is pending commit.
> 
> Signed-off-by: Adam Thomas <adamthomas1111 at gmail.com>

Pushed both to linux-ubifs.git, added 'Cc: stable at vger.kernel.org'.

-- 
Best Regards,
Artem Bityutskiy
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
URL: <http://lists.infradead.org/pipermail/linux-mtd/attachments/20130204/634c37ac/attachment.sig>