17 files changed, 53 insertions, 55 deletions

diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c
index 8457df7ec5af..33c64955d4d7 100644
--- a/drivers/mtd/ubi/block.c
+++ b/drivers/mtd/ubi/block.c
@@ -378,9 +378,11 @@ int ubiblock_create(struct ubi_volume_info *vi)
 {
         struct ubiblock *dev;
         struct gendisk *gd;
-        int disk_capacity;
+        u64 disk_capacity = ((u64)vi->size * vi->usable_leb_size) >> 9;
         int ret;
 
+        if ((sector_t)disk_capacity != disk_capacity)
+                return -EFBIG;
         /* Check that the volume isn't already handled */
         mutex_lock(&devices_mutex);
         if (find_dev_nolock(vi->ubi_num, vi->vol_id)) {
@@ -412,7 +414,6 @@ int ubiblock_create(struct ubi_volume_info *vi)
         gd->first_minor = dev->ubi_num * UBI_MAX_VOLUMES + dev->vol_id;
         gd->private_data = dev;
         sprintf(gd->disk_name, "ubiblock%d_%d", dev->ubi_num, dev->vol_id);
-        disk_capacity = (vi->size * vi->usable_leb_size) >> 9;
         set_capacity(gd, disk_capacity);
         dev->gd = gd;
 
@@ -498,11 +499,16 @@ int ubiblock_remove(struct ubi_volume_info *vi)
         return 0;
 }
 
-static void ubiblock_resize(struct ubi_volume_info *vi)
+static int ubiblock_resize(struct ubi_volume_info *vi)
 {
         struct ubiblock *dev;
-        int disk_capacity;
+        u64 disk_capacity = ((u64)vi->size * vi->usable_leb_size) >> 9;
 
+        if ((sector_t)disk_capacity != disk_capacity) {
+                ubi_warn("%s: the volume is too big, cannot resize (%d LEBs)",
+                         dev->gd->disk_name, vi->size);
+                return -EFBIG;
+        }
         /*
          * Need to lock the device list until we stop using the device,
          * otherwise the device struct might get released in
@@ -512,15 +518,15 @@ static void ubiblock_resize(struct ubi_volume_info *vi)
         dev = find_dev_nolock(vi->ubi_num, vi->vol_id);
         if (!dev) {
                 mutex_unlock(&devices_mutex);
-                return;
+                return -ENODEV;
         }
 
         mutex_lock(&dev->dev_mutex);
-        disk_capacity = (vi->size * vi->usable_leb_size) >> 9;
         set_capacity(dev->gd, disk_capacity);
         ubi_msg("%s resized to %d LEBs", dev->gd->disk_name, vi->size);
         mutex_unlock(&dev->dev_mutex);
         mutex_unlock(&devices_mutex);
+        return 0;
 }
 
 static int ubiblock_notify(struct notifier_block *nb,
diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
index d77b1c1d7c72..07cac5f9ffb8 100644
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -591,7 +591,7 @@ static int init_volumes(struct ubi_device *ubi,
 
                 /* Static volumes only */
                 av = ubi_find_av(ai, i);
-                if (!av) {
+                if (!av || !av->leb_count) {
                         /*
                          * No eraseblocks belonging to this volume found. We
                          * don't actually know whether this static volume is
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 0f3425dac910..20f491713145 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -1718,12 +1718,12 @@ int ubi_wl_flush(struct ubi_device *ubi, int vol_id, int lnum)
                vol_id, lnum, ubi->works_count);
 
         while (found) {
-                struct ubi_work *wrk;
+                struct ubi_work *wrk, *tmp;
                 found = 0;
 
                 down_read(&ubi->work_sem);
                 spin_lock(&ubi->wl_lock);
-                list_for_each_entry(wrk, &ubi->works, list) {
+                list_for_each_entry_safe(wrk, tmp, &ubi->works, list) {
                         if ((vol_id == UBI_ALL || wrk->vol_id == vol_id) &&
                             (lnum == UBI_ALL || wrk->lnum == lnum)) {
                                 list_del(&wrk->list);
diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c
index ff8229340cd5..aa13ad053b14 100644
--- a/fs/ubifs/commit.c
+++ b/fs/ubifs/commit.c
@@ -174,7 +174,6 @@ static int do_commit(struct ubifs_info *c)
         if (err)
                 goto out;
 
-        mutex_lock(&c->mst_mutex);
         c->mst_node->cmt_no      = cpu_to_le64(c->cmt_no);
         c->mst_node->log_lnum    = cpu_to_le32(new_ltail_lnum);
         c->mst_node->root_lnum   = cpu_to_le32(zroot.lnum);
@@ -204,7 +203,6 @@ static int do_commit(struct ubifs_info *c)
         else
                 c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_NO_ORPHS);
         err = ubifs_write_master(c);
-        mutex_unlock(&c->mst_mutex);
         if (err)
                 goto out;
 
diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index 2290d5866725..fb08b0c514b6 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -431,7 +431,7 @@ void ubifs_prep_grp_node(struct ubifs_info *c, void *node, int len, int last)
 
 /**
  * wbuf_timer_callback - write-buffer timer callback function.
- * @data: timer data (write-buffer descriptor)
+ * @timer: timer data (write-buffer descriptor)
  *
  * This function is called when the write-buffer timer expires.
  */
diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c
index a902c5919e42..a47ddfc9be6b 100644
--- a/fs/ubifs/log.c
+++ b/fs/ubifs/log.c
@@ -240,6 +240,7 @@ int ubifs_add_bud_to_log(struct ubifs_info *c, int jhead, int lnum, int offs)
 
         if (c->lhead_offs > c->leb_size - c->ref_node_alsz) {
                 c->lhead_lnum = ubifs_next_log_lnum(c, c->lhead_lnum);
+                ubifs_assert(c->lhead_lnum != c->ltail_lnum);
                 c->lhead_offs = 0;
         }
 
@@ -404,15 +405,14 @@ int ubifs_log_start_commit(struct ubifs_info *c, int *ltail_lnum)
         /* Switch to the next log LEB */
         if (c->lhead_offs) {
                 c->lhead_lnum = ubifs_next_log_lnum(c, c->lhead_lnum);
+                ubifs_assert(c->lhead_lnum != c->ltail_lnum);
                 c->lhead_offs = 0;
         }
 
-        if (c->lhead_offs == 0) {
-                /* Must ensure next LEB has been unmapped */
-                err = ubifs_leb_unmap(c, c->lhead_lnum);
-                if (err)
-                        goto out;
-        }
+        /* Must ensure next LEB has been unmapped */
+        err = ubifs_leb_unmap(c, c->lhead_lnum);
+        if (err)
+                goto out;
 
         len = ALIGN(len, c->min_io_size);
         dbg_log("writing commit start at LEB %d:0, len %d", c->lhead_lnum, len);
diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index d46b19ec1815..421bd0a80424 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -1464,7 +1464,6 @@ struct ubifs_lprops *ubifs_lpt_lookup(struct ubifs_info *c, int lnum)
                         return ERR_CAST(nnode);
         }
         iip = ((i >> shft) & (UBIFS_LPT_FANOUT - 1));
-        shft -= UBIFS_LPT_FANOUT_SHIFT;
         pnode = ubifs_get_pnode(c, nnode, iip);
         if (IS_ERR(pnode))
                 return ERR_CAST(pnode);
@@ -1604,7 +1603,6 @@ struct ubifs_lprops *ubifs_lpt_lookup_dirty(struct ubifs_info *c, int lnum)
                         return ERR_CAST(nnode);
         }
         iip = ((i >> shft) & (UBIFS_LPT_FANOUT - 1));
-        shft -= UBIFS_LPT_FANOUT_SHIFT;
         pnode = ubifs_get_pnode(c, nnode, iip);
         if (IS_ERR(pnode))
                 return ERR_CAST(pnode);
@@ -1964,7 +1962,6 @@ again:
                 }
         }
         iip = ((i >> shft) & (UBIFS_LPT_FANOUT - 1));
-        shft -= UBIFS_LPT_FANOUT_SHIFT;
         pnode = scan_get_pnode(c, path + h, nnode, iip);
         if (IS_ERR(pnode)) {
                 err = PTR_ERR(pnode);
@@ -2198,6 +2195,7 @@ static int dbg_chk_pnode(struct ubifs_info *c, struct ubifs_pnode *pnode,
                                           lprops->dirty);
                                 return -EINVAL;
                         }
+                        break;
                 case LPROPS_FREEABLE:
                 case LPROPS_FRDI_IDX:
                         if (lprops->free + lprops->dirty != c->leb_size) {
@@ -2206,6 +2204,7 @@ static int dbg_chk_pnode(struct ubifs_info *c, struct ubifs_pnode *pnode,
                                           lprops->dirty);
                                 return -EINVAL;
                         }
+                        break;
                 }
         }
         return 0;
diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
index 45d4e96a6bac..d9c02928e992 100644
--- a/fs/ubifs/lpt_commit.c
+++ b/fs/ubifs/lpt_commit.c
@@ -304,7 +304,6 @@ static int layout_cnodes(struct ubifs_info *c)
                         ubifs_assert(lnum >= c->lpt_first &&
                                      lnum <= c->lpt_last);
                 }
-                done_ltab = 1;
                 c->ltab_lnum = lnum;
                 c->ltab_offs = offs;
                 offs += c->ltab_sz;
@@ -514,7 +513,6 @@ static int write_cnodes(struct ubifs_info *c)
                         if (err)
                                 return err;
                 }
-                done_ltab = 1;
                 ubifs_pack_ltab(c, buf + offs, c->ltab_cmt);
                 offs += c->ltab_sz;
                 dbg_chk_lpt_sz(c, 1, c->ltab_sz);
@@ -1941,6 +1939,11 @@ static void dump_lpt_leb(const struct ubifs_info *c, int lnum)
                                 pr_err("LEB %d:%d, nnode, ",
                                        lnum, offs);
                         err = ubifs_unpack_nnode(c, p, &nnode);
+                        if (err) {
+                                pr_err("failed to unpack_node, error %d\n",
+                                       err);
+                                break;
+                        }
                         for (i = 0; i < UBIFS_LPT_FANOUT; i++) {
                                 pr_cont("%d:%d", nnode.nbranch[i].lnum,
                                        nnode.nbranch[i].offs);
diff --git a/fs/ubifs/master.c b/fs/ubifs/master.c
index ab83ace9910a..1a4bb9e8b3b8 100644
--- a/fs/ubifs/master.c
+++ b/fs/ubifs/master.c
@@ -352,10 +352,9 @@ int ubifs_read_master(struct ubifs_info *c)
  * ubifs_write_master - write master node.
  * @c: UBIFS file-system description object
  *
- * This function writes the master node. The caller has to take the
- * @c->mst_mutex lock before calling this function. Returns zero in case of
- * success and a negative error code in case of failure. The master node is
- * written twice to enable recovery.
+ * This function writes the master node. Returns zero in case of success and a
+ * negative error code in case of failure. The master node is written twice to
+ * enable recovery.
  */
 int ubifs_write_master(struct ubifs_info *c)
 {
diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c
index f1c3e5a1b315..4409f486ecef 100644
--- a/fs/ubifs/orphan.c
+++ b/fs/ubifs/orphan.c
@@ -346,7 +346,6 @@ static int write_orph_nodes(struct ubifs_info *c, int atomic)
                 int lnum;
 
                 /* Unmap any unused LEBs after consolidation */
-                lnum = c->ohead_lnum + 1;
                 for (lnum = c->ohead_lnum + 1; lnum <= c->orph_last; lnum++) {
                         err = ubifs_leb_unmap(c, lnum);
                         if (err)
diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
index c14adb2f420c..c640938f62f0 100644
--- a/fs/ubifs/recovery.c
+++ b/fs/ubifs/recovery.c
@@ -596,7 +596,6 @@ static void drop_last_group(struct ubifs_scan_leb *sleb, int *offs)
  * drop_last_node - drop the last node.
  * @sleb: scanned LEB information
  * @offs: offset of dropped nodes is returned here
- * @grouped: non-zero if whole group of nodes have to be dropped
  *
  * This is a helper function for 'ubifs_recover_leb()' which drops the last
  * node of the scanned LEB.
@@ -629,8 +628,8 @@ static void drop_last_node(struct ubifs_scan_leb *sleb, int *offs)
  *
  * This function does a scan of a LEB, but caters for errors that might have
  * been caused by the unclean unmount from which we are attempting to recover.
- * Returns %0 in case of success, %-EUCLEAN if an unrecoverable corruption is
- * found, and a negative error code in case of failure.
+ * Returns the scanned information on success and a negative error code on
+ * failure.
  */
 struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
                                          int offs, void *sbuf, int jhead)
diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c
index 4c37607a958e..79c6dbbc0e04 100644
--- a/fs/ubifs/sb.c
+++ b/fs/ubifs/sb.c
@@ -332,6 +332,8 @@ static int create_default_filesystem(struct ubifs_info *c)
         cs->ch.node_type = UBIFS_CS_NODE;
         err = ubifs_write_node(c, cs, UBIFS_CS_NODE_SZ, UBIFS_LOG_LNUM, 0);
         kfree(cs);
+        if (err)
+                return err;
 
         ubifs_msg("default file-system created");
         return 0;
@@ -447,7 +449,7 @@ static int validate_sb(struct ubifs_info *c, struct ubifs_sb_node *sup)
                 goto failed;
         }
 
-        if (c->default_compr < 0 || c->default_compr >= UBIFS_COMPR_TYPES_CNT) {
+        if (c->default_compr >= UBIFS_COMPR_TYPES_CNT) {
                 err = 13;
                 goto failed;
         }
diff --git a/fs/ubifs/scan.c b/fs/ubifs/scan.c
index 58aa05df2bb6..89adbc4d08ac 100644
--- a/fs/ubifs/scan.c
+++ b/fs/ubifs/scan.c
@@ -131,7 +131,8 @@ int ubifs_scan_a_node(const struct ubifs_info *c, void *buf, int len, int lnum,
  * @offs: offset to start at (usually zero)
  * @sbuf: scan buffer (must be c->leb_size)
  *
- * This function returns %0 on success and a negative error code on failure.
+ * This function returns the scanned information on success and a negative error
+ * code on failure.
  */
 struct ubifs_scan_leb *ubifs_start_scan(const struct ubifs_info *c, int lnum,
                                         int offs, void *sbuf)
@@ -157,9 +158,10 @@ struct ubifs_scan_leb *ubifs_start_scan(const struct ubifs_info *c, int lnum,
                 return ERR_PTR(err);
         }
 
-        if (err == -EBADMSG)
-                sleb->ecc = 1;
-
+        /*
+         * Note, we ignore integrity errors (EBASMSG) because all the nodes are
+         * protected by CRC checksums.
+         */
         return sleb;
 }
 
@@ -169,8 +171,6 @@ struct ubifs_scan_leb *ubifs_start_scan(const struct ubifs_info *c, int lnum,
  * @sleb: scanning information
  * @lnum: logical eraseblock number
  * @offs: offset to start at (usually zero)
- *
- * This function returns %0 on success and a negative error code on failure.
  */
 void ubifs_end_scan(const struct ubifs_info *c, struct ubifs_scan_leb *sleb,
                     int lnum, int offs)
@@ -257,7 +257,7 @@ void ubifs_scanned_corruption(const struct ubifs_info *c, int lnum, int offs,
  * @quiet: print no messages
  *
  * This function scans LEB number @lnum and returns complete information about
- * its contents. Returns the scaned information in case of success and,
+ * its contents. Returns the scanned information in case of success and,
  * %-EUCLEAN if the LEB neads recovery, and other negative error codes in case
  * of failure.
  *
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 3904c8574ef9..106bf20629ce 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -75,7 +75,7 @@ static int validate_inode(struct ubifs_info *c, const struct inode *inode)
                 return 1;
         }
 
-        if (ui->compr_type < 0 || ui->compr_type >= UBIFS_COMPR_TYPES_CNT) {
+        if (ui->compr_type >= UBIFS_COMPR_TYPES_CNT) {
                 ubifs_err("unknown compression type %d", ui->compr_type);
                 return 2;
         }
@@ -424,19 +424,19 @@ static int ubifs_show_options(struct seq_file *s, struct dentry *root)
         struct ubifs_info *c = root->d_sb->s_fs_info;
 
         if (c->mount_opts.unmount_mode == 2)
-                seq_printf(s, ",fast_unmount");
+                seq_puts(s, ",fast_unmount");
         else if (c->mount_opts.unmount_mode == 1)
-                seq_printf(s, ",norm_unmount");
+                seq_puts(s, ",norm_unmount");
 
         if (c->mount_opts.bulk_read == 2)
-                seq_printf(s, ",bulk_read");
+                seq_puts(s, ",bulk_read");
         else if (c->mount_opts.bulk_read == 1)
-                seq_printf(s, ",no_bulk_read");
+                seq_puts(s, ",no_bulk_read");
 
         if (c->mount_opts.chk_data_crc == 2)
-                seq_printf(s, ",chk_data_crc");
+                seq_puts(s, ",chk_data_crc");
         else if (c->mount_opts.chk_data_crc == 1)
-                seq_printf(s, ",no_chk_data_crc");
+                seq_puts(s, ",no_chk_data_crc");
 
         if (c->mount_opts.override_compr) {
                 seq_printf(s, ",compr=%s",
@@ -796,8 +796,8 @@ static int alloc_wbufs(struct ubifs_info *c)
 {
         int i, err;
 
-        c->jheads = kzalloc(c->jhead_cnt * sizeof(struct ubifs_jhead),
-                           GFP_KERNEL);
+        c->jheads = kcalloc(c->jhead_cnt, sizeof(struct ubifs_jhead),
+                            GFP_KERNEL);
         if (!c->jheads)
                 return -ENOMEM;
 
@@ -1963,7 +1963,6 @@ static struct ubifs_info *alloc_ubifs_info(struct ubi_volume_desc *ubi)
                 mutex_init(&c->lp_mutex);
                 mutex_init(&c->tnc_mutex);
                 mutex_init(&c->log_mutex);
-                mutex_init(&c->mst_mutex);
                 mutex_init(&c->umount_mutex);
                 mutex_init(&c->bu_mutex);
                 mutex_init(&c->write_reserve_mutex);
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index 8a40cf9c02d7..6793db0754f6 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -3294,7 +3294,6 @@ int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
                 goto out_unlock;
 
         if (err) {
-                err = -EINVAL;
                 key = &from_key;
                 goto out_dump;
         }
diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
index 3600994f8411..7a205e046776 100644
--- a/fs/ubifs/tnc_commit.c
+++ b/fs/ubifs/tnc_commit.c
@@ -389,7 +389,6 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
                                 ubifs_dump_lprops(c);
                         }
                         /* Try to commit anyway */
-                        err = 0;
                         break;
                 }
                 p++;
diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
index c1f71fe17cc0..c4fe900c67ab 100644
--- a/fs/ubifs/ubifs.h
+++ b/fs/ubifs/ubifs.h
@@ -314,7 +314,6 @@ struct ubifs_scan_node {
  * @nodes_cnt: number of nodes scanned
  * @nodes: list of struct ubifs_scan_node
  * @endpt: end point (and therefore the start of empty space)
- * @ecc: read returned -EBADMSG
  * @buf: buffer containing entire LEB scanned
  */
 struct ubifs_scan_leb {
@@ -322,7 +321,6 @@ struct ubifs_scan_leb {
         int nodes_cnt;
         struct list_head nodes;
         int endpt;
-        int ecc;
         void *buf;
 };
 
@@ -1051,7 +1049,6 @@ struct ubifs_debug_info;
  *
  * @mst_node: master node
  * @mst_offs: offset of valid master node
- * @mst_mutex: protects the master node area, @mst_node, and @mst_offs
  *
  * @max_bu_buf_len: maximum bulk-read buffer length
  * @bu_mutex: protects the pre-allocated bulk-read buffer and @c->bu
@@ -1292,7 +1289,6 @@ struct ubifs_info {
 
         struct ubifs_mst_node *mst_node;
         int mst_offs;
-        struct mutex mst_mutex;
 
         int max_bu_buf_len;
         struct mutex bu_mutex;