Merge branch 'linux-next' of git://git.infradead.org/ubifs-2.6

* 'linux-next' of git://git.infradead.org/ubifs-2.6:
  UBIFS: fix-up free space earlier
  UBIFS: intialize LPT earlier
  UBIFS: assert no fixup when writing a node
  UBIFS: fix clean znode counter corruption in error cases
  UBIFS: fix memory leak on error path
  UBIFS: fix shrinker object count reports
  UBIFS: fix recovery broken by the previous recovery fix
  UBIFS: amend ubifs_recover_leb interface
  UBIFS: introduce a "grouped" journal head flag
  UBIFS: supress false error messages

9 files changed, 136 insertions, 97 deletions

diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index 166951e0dcd3..3be645e012c9 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -581,6 +581,7 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
         ubifs_assert(wbuf->size % c->min_io_size == 0);
         ubifs_assert(mutex_is_locked(&wbuf->io_mutex));
         ubifs_assert(!c->ro_media && !c->ro_mount);
+        ubifs_assert(!c->space_fixup);
         if (c->leb_size - wbuf->offs >= c->max_write_size)
                 ubifs_assert(!((wbuf->offs + wbuf->size) % c->max_write_size));
 
@@ -759,6 +760,7 @@ int ubifs_write_node(struct ubifs_info *c, void *buf, int len, int lnum,
         ubifs_assert(lnum >= 0 && lnum < c->leb_cnt && offs >= 0);
         ubifs_assert(offs % c->min_io_size == 0 && offs < c->leb_size);
         ubifs_assert(!c->ro_media && !c->ro_mount);
+        ubifs_assert(!c->space_fixup);
 
         if (c->ro_error)
                 return -EROFS;
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index 34b1679e6e3a..cef0460f4c54 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -669,6 +669,7 @@ out_free:
 
 out_release:
         release_head(c, BASEHD);
+        kfree(dent);
 out_ro:
         ubifs_ro_mode(c, err);
         if (last_reference)
diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c
index bd644bf587a8..a5422fffbd69 100644
--- a/fs/ubifs/orphan.c
+++ b/fs/ubifs/orphan.c
@@ -674,7 +674,7 @@ static int kill_orphans(struct ubifs_info *c)
                 if (IS_ERR(sleb)) {
                         if (PTR_ERR(sleb) == -EUCLEAN)
                                 sleb = ubifs_recover_leb(c, lnum, 0,
-                                                         c->sbuf, 0);
+                                                         c->sbuf, -1);
                         if (IS_ERR(sleb)) {
                                 err = PTR_ERR(sleb);
                                 break;
diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
index 731d9e2e7b50..783d8e0beb76 100644
--- a/fs/ubifs/recovery.c
+++ b/fs/ubifs/recovery.c
@@ -564,19 +564,15 @@ static int fix_unclean_leb(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
 }
 
 /**
- * drop_last_node - drop the last node or group of nodes.
+ * drop_last_group - drop the last group of nodes.
  * @sleb: scanned LEB information
  * @offs: offset of dropped nodes is returned here
- * @grouped: non-zero if whole group of nodes have to be dropped
  *
  * This is a helper function for 'ubifs_recover_leb()' which drops the last
- * node of the scanned LEB or the last group of nodes if @grouped is not zero.
- * This function returns %1 if a node was dropped and %0 otherwise.
+ * group of nodes of the scanned LEB.
  */
-static int drop_last_node(struct ubifs_scan_leb *sleb, int *offs, int grouped)
+static void drop_last_group(struct ubifs_scan_leb *sleb, int *offs)
 {
-        int dropped = 0;
-
         while (!list_empty(&sleb->nodes)) {
                 struct ubifs_scan_node *snod;
                 struct ubifs_ch *ch;
@@ -585,17 +581,40 @@ static int drop_last_node(struct ubifs_scan_leb *sleb, int *offs, int grouped)
                                   list);
                 ch = snod->node;
                 if (ch->group_type != UBIFS_IN_NODE_GROUP)
-                        return dropped;
-                dbg_rcvry("dropping node at %d:%d", sleb->lnum, snod->offs);
+                        break;
+
+                dbg_rcvry("dropping grouped node at %d:%d",
+                          sleb->lnum, snod->offs);
+                *offs = snod->offs;
+                list_del(&snod->list);
+                kfree(snod);
+                sleb->nodes_cnt -= 1;
+        }
+}
+
+/**
+ * drop_last_node - drop the last node.
+ * @sleb: scanned LEB information
+ * @offs: offset of dropped nodes is returned here
+ * @grouped: non-zero if whole group of nodes have to be dropped
+ *
+ * This is a helper function for 'ubifs_recover_leb()' which drops the last
+ * node of the scanned LEB.
+ */
+static void drop_last_node(struct ubifs_scan_leb *sleb, int *offs)
+{
+        struct ubifs_scan_node *snod;
+
+        if (!list_empty(&sleb->nodes)) {
+                snod = list_entry(sleb->nodes.prev, struct ubifs_scan_node,
+                                  list);
+
+                dbg_rcvry("dropping last node at %d:%d", sleb->lnum, snod->offs);
                 *offs = snod->offs;
                 list_del(&snod->list);
                 kfree(snod);
                 sleb->nodes_cnt -= 1;
-                dropped = 1;
-                if (!grouped)
-                        break;
         }
-        return dropped;
 }
 
 /**
@@ -604,7 +623,8 @@ static int drop_last_node(struct ubifs_scan_leb *sleb, int *offs, int grouped)
  * @lnum: LEB number
  * @offs: offset
  * @sbuf: LEB-sized buffer to use
- * @grouped: nodes may be grouped for recovery
+ * @jhead: journal head number this LEB belongs to (%-1 if the LEB does not
+ *         belong to any journal head)
  *
  * This function does a scan of a LEB, but caters for errors that might have
  * been caused by the unclean unmount from which we are attempting to recover.
@@ -612,13 +632,14 @@ static int drop_last_node(struct ubifs_scan_leb *sleb, int *offs, int grouped)
  * found, and a negative error code in case of failure.
  */
 struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
-                                         int offs, void *sbuf, int grouped)
+                                         int offs, void *sbuf, int jhead)
 {
         int ret = 0, err, len = c->leb_size - offs, start = offs, min_io_unit;
+        int grouped = jhead == -1 ? 0 : c->jheads[jhead].grouped;
         struct ubifs_scan_leb *sleb;
         void *buf = sbuf + offs;
 
-        dbg_rcvry("%d:%d", lnum, offs);
+        dbg_rcvry("%d:%d, jhead %d, grouped %d", lnum, offs, jhead, grouped);
 
         sleb = ubifs_start_scan(c, lnum, offs, sbuf);
         if (IS_ERR(sleb))
@@ -635,7 +656,7 @@ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
                  * Scan quietly until there is an error from which we cannot
                  * recover
                  */
-                ret = ubifs_scan_a_node(c, buf, len, lnum, offs, 0);
+                ret = ubifs_scan_a_node(c, buf, len, lnum, offs, 1);
                 if (ret == SCANNED_A_NODE) {
                         /* A valid node, and not a padding node */
                         struct ubifs_ch *ch = buf;
@@ -695,59 +716,62 @@ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
                  * If nodes are grouped, always drop the incomplete group at
                  * the end.