android_kernel_google_msm/fs/ubifs
Adam Thomas 8a4188e2d8 UBIFS: fix double free of ubifs_orphan objects
commit 8afd500cb5 upstream.

The last orphan in the dnext list has its dnext set to NULL. Because
of that, ubifs_delete_orphan assumes that it is not on the dnext list
and frees it immediately instead ignoring it as a second delete. The
orphan is later freed again by erase_deleted.

This change adds an explicit flag to ubifs_orphan indicating whether
it is pending delete.

Signed-off-by: Adam Thomas <adamthomas1111@gmail.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-11 16:10:05 -07:00
..
budget.c
commit.c
compress.c
debug.c UBIFS: make the dbg_lock spinlock static 2012-02-29 16:10:20 +02:00
debug.h UBIFS: fix complaints about too small debug buffer size 2012-09-14 10:00:17 -07:00
dir.c UBIFS: fix a horrid bug 2013-07-03 10:59:05 -07:00
file.c ubifs: remove the second argument of k[un]map_atomic() 2012-03-20 21:48:26 +08:00
find.c UBIFS: fix mounting problems after power cuts 2012-11-26 11:37:44 -08:00
gc.c
io.c
ioctl.c
journal.c UBIFS: fix key printing 2012-01-13 12:50:42 +02:00
Kconfig
key.h
log.c
lprops.c UBIFS: introduce categorized lprops counter 2012-11-26 11:37:44 -08:00
lpt.c
lpt_commit.c
Makefile
master.c
misc.h
orphan.c UBIFS: fix double free of ubifs_orphan objects 2014-03-11 16:10:05 -07:00
recovery.c UBIFS: amend recovery debugging message 2012-02-29 16:10:20 +02:00
replay.c UBIFS: fix key printing 2012-01-13 12:50:42 +02:00
sb.c UBIFS: fix a bug in empty space fix-up 2012-07-29 08:04:20 -07:00
scan.c
shrinker.c
super.c UBIFS: make space fixup work in the remount case 2013-04-12 09:38:43 -07:00
tnc.c Merge branch 'linux-next' of git://git.infradead.org/ubifs-2.6 2012-01-13 10:31:33 -08:00
tnc_commit.c
tnc_misc.c UBIFS: fix key printing 2012-01-13 12:50:42 +02:00
ubifs-media.h
ubifs.h UBIFS: fix double free of ubifs_orphan objects 2014-03-11 16:10:05 -07:00
xattr.c