4 files changed, 50 insertions, 197 deletions

diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
index 99871279a1ed..c2530197be0c 100644
--- a/fs/jffs2/file.c
+++ b/fs/jffs2/file.c
@@ -47,7 +47,7 @@ const struct file_operations jffs2_file_operations =
         .ioctl =        jffs2_ioctl,
         .mmap =         generic_file_readonly_mmap,
         .fsync =        jffs2_fsync,
-        .sendfile =     generic_file_sendfile
+        .splice_read =  generic_file_splice_read,
 };
 
 /* jffs2_file_inode_operations */
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 4884d5edfe65..7b363786c2d2 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -210,8 +210,7 @@ static void jffs2_kill_tn(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *
  * offset, and the one with the smallest length will come first in the
  * ordering.
  *
- * Returns 0 if the node was inserted
- *         1 if the node is obsolete (because we can't mark it so yet)
+ * Returns 0 if the node was handled (including marking it obsolete)
  *         < 0 an if error occurred
  */
 static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
@@ -229,9 +228,16 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
            check anyway. */
         if (!tn->fn->size) {
                 if (rii->mdata_tn) {
-                        /* We had a candidate mdata node already */
-                        dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
-                        jffs2_kill_tn(c, rii->mdata_tn);
+                        if (rii->mdata_tn->version < tn->version) {
+                                /* We had a candidate mdata node already */
+                                dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
+                                jffs2_kill_tn(c, rii->mdata_tn);
+                        } else {
+                                dbg_readinode("kill new mdata with ver %d (older than existing %d\n",
+                                              tn->version, rii->mdata_tn->version);
+                                jffs2_kill_tn(c, tn);
+                                return 0;
+                        }
                 }
                 rii->mdata_tn = tn;
                 dbg_readinode("keep new mdata with ver %d\n", tn->version);
@@ -565,8 +571,7 @@ static struct jffs2_raw_node_ref *jffs2_first_valid_node(struct jffs2_raw_node_r
  * Helper function for jffs2_get_inode_nodes().
  * It is called every time an directory entry node is found.
  *
- * Returns: 0 on succes;
- *          1 if the node should be marked obsolete;
+ * Returns: 0 on success;
  *          negative error code on failure.
  */
 static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
@@ -673,8 +678,7 @@ static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_r
  * Helper function for jffs2_get_inode_nodes().
  * It is called every time an inode node is found.
  *
- * Returns: 0 on success;
- *          1 if the node should be marked obsolete;
+ * Returns: 0 on success (possibly after marking a bad node obsolete);
  *          negative error code on failure.
  */
 static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
@@ -683,7 +687,7 @@ static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
 {
         struct jffs2_tmp_dnode_info *tn;
         uint32_t len, csize;
-        int ret = 1;
+        int ret = 0;
         uint32_t crc;
 
         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
@@ -712,8 +716,9 @@ static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
                 /* Sanity checks */
                 if (unlikely(je32_to_cpu(rd->offset) > je32_to_cpu(rd->isize)) ||
                     unlikely(PAD(je32_to_cpu(rd->csize) + sizeof(*rd)) != PAD(je32_to_cpu(rd->totlen)))) {
-                                JFFS2_WARNING("inode node header CRC is corrupted at %#08x\n", ref_offset(ref));
-                                jffs2_dbg_dump_node(c, ref_offset(ref));
+                        JFFS2_WARNING("inode node header CRC is corrupted at %#08x\n", ref_offset(ref));
+                        jffs2_dbg_dump_node(c, ref_offset(ref));
+                        jffs2_mark_node_obsolete(c, ref);
                         goto free_out;
                 }
 
@@ -768,6 +773,7 @@ static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
                         if (len >= csize && unlikely(tn->partial_crc != je32_to_cpu(rd->data_crc))) {
                                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
                                         ref_offset(ref), tn->partial_crc, je32_to_cpu(rd->data_crc));
+                                jffs2_mark_node_obsolete(c, ref);
                                 goto free_out;
                         }
 
@@ -847,7 +853,6 @@ static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
  * It is called every time an unknown node is found.
  *
  * Returns: 0 on success;
- *          1 if the node should be marked obsolete;
  *          negative error code on failure.
  */
 static inline int read_unknown(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref, struct jffs2_unknown_node *un)
@@ -1044,7 +1049,8 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
 
                 case JFFS2_NODETYPE_DIRENT:
 
-                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent)) {
+                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent) &&
+                            len < sizeof(struct jffs2_raw_dirent)) {
                                 err = read_more(c, ref, sizeof(struct jffs2_raw_dirent), &len, buf);
                                 if (unlikely(err))
                                         goto free_out;
@@ -1058,7 +1064,8 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
 
                 case JFFS2_NODETYPE_INODE:
 
-                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode)) {
+                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode) &&
+                            len < sizeof(struct jffs2_raw_inode)) {
                                 err = read_more(c, ref, sizeof(struct jffs2_raw_inode), &len, buf);
                                 if (unlikely(err))
                                         goto free_out;
@@ -1071,17 +1078,15 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
                         break;
 
                 default:
-                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node)) {
+                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node) &&
+                            len < sizeof(struct jffs2_unknown_node)) {
                                 err = read_more(c, ref, sizeof(struct jffs2_unknown_node), &len, buf);
                                 if (unlikely(err))
                                         goto free_out;
                         }
 
                         err = read_unknown(c, ref, &node->u);
-                        if (err == 1) {
-                                jffs2_mark_node_obsolete(c, ref);
-                                break;
-                        } else if (unlikely(err))
+                        if (unlikely(err))
                                 goto free_out;
 
                 }
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index 6488af43bc9b..e220d3bd610d 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -19,7 +19,7 @@
 #include <linux/mount.h>
 #include <linux/jffs2.h>
 #include <linux/pagemap.h>
-#include <linux/mtd/mtd.h>
+#include <linux/mtd/super.h>
 #include <linux/ctype.h>
 #include <linux/namei.h>
 #include "compr.h"
@@ -75,69 +75,27 @@ static const struct super_operations jffs2_super_operations =
         .sync_fs =      jffs2_sync_fs,
 };
 
-static int jffs2_sb_compare(struct super_block *sb, void *data)
-{
-        struct jffs2_sb_info *p = data;
-        struct jffs2_sb_info *c = JFFS2_SB_INFO(sb);
-
-        /* The superblocks are considered to be equivalent if the underlying MTD
-           device is the same one */
-        if (c->mtd == p->mtd) {
-                D1(printk(KERN_DEBUG "jffs2_sb_compare: match on device %d (\"%s\")\n", p->mtd->index, p->mtd->name));
-                return 1;
-        } else {
-                D1(printk(KERN_DEBUG "jffs2_sb_compare: No match, device %d (\"%s\"), device %d (\"%s\")\n",
-                          c->mtd->index, c->mtd->name, p->mtd->index, p->mtd->name));
-                return 0;
-        }
-}
-
-static int jffs2_sb_set(struct super_block *sb, void *data)
-{
-        struct jffs2_sb_info *p = data;
-
-        /* For persistence of NFS exports etc. we use the same s_dev
-           each time we mount the device, don't just use an anonymous
-           device */
-        sb->s_fs_info = p;
-        p->os_priv = sb;
-        sb->s_dev = MKDEV(MTD_BLOCK_MAJOR, p->mtd->index);
-
-        return 0;
-}
-
-static int jffs2_get_sb_mtd(struct file_system_type *fs_type,
-                            int flags, const char *dev_name,
-                            void *data, struct mtd_info *mtd,
-                            struct vfsmount *mnt)
+/*
+ * fill in the superblock
+ */
+static int jffs2_fill_super(struct super_block *sb, void *data, int silent)
 {
-        struct super_block *sb;
         struct jffs2_sb_info *c;
-        int ret;
+
+        D1(printk(KERN_DEBUG "jffs2_get_sb_mtd():"
+                  " New superblock for device %d (\"%s\")\n",
+                  sb->s_mtd->index, sb->s_mtd->name));
 
         c = kzalloc(sizeof(*c), GFP_KERNEL);
         if (!c)
                 return -ENOMEM;
-        c->mtd = mtd;
-
-        sb = sget(fs_type, jffs2_sb_compare, jffs2_sb_set, c);
-
-        if (IS_ERR(sb))
-                goto out_error;
-
-        if (sb->s_root) {
-                /* New mountpoint for JFFS2 which is already mounted */
-                D1(printk(KERN_DEBUG "jffs2_get_sb_mtd(): Device %d (\"%s\") is already mounted\n",
-                          mtd->index, mtd->name));
-                ret = simple_set_mnt(mnt, sb);
-                goto out_put;
-        }
 
-        D1(printk(KERN_DEBUG "jffs2_get_sb_mtd(): New superblock for device %d (\"%s\")\n",
-                  mtd->index, mtd->name));
+        c->mtd = sb->s_mtd;
+        c->os_priv = sb;
+        sb->s_fs_info = c;
 
-        /* Initialize JFFS2 superblock locks, the further initialization will be
-         * done later */
+        /* Initialize JFFS2 superblock locks, the further initialization will
+         * be done later */
         init_MUTEX(&c->alloc_sem);
         init_MUTEX(&c->erase_free_sem);
         init_waitqueue_head(&c->erase_wait);
@@ -146,133 +104,20 @@ static int jffs2_get_sb_mtd(struct file_system_type *fs_type,
         spin_lock_init(&c->inocache_lock);
 
         sb->s_op = &jffs2_super_operations;
-        sb->s_flags = flags | MS_NOATIME;
+        sb->s_flags = sb->s_flags | MS_NOATIME;
         sb->s_xattr = jffs2_xattr_handlers;
 #ifdef CONFIG_JFFS2_FS_POSIX_ACL
         sb->s_flags |= MS_POSIXACL;
 #endif
-        ret = jffs2_do_fill_super(sb, data, flags & MS_SILENT ? 1 : 0);
-
-        if (ret) {
-                /* Failure case... */
-                up_write(&sb->s_umount);
-                deactivate_super(sb);
-                return ret;
-        }
-
-        sb->s_flags |= MS_ACTIVE;
-        return simple_set_mnt(mnt, sb);
-
-out_error:
-        ret = PTR_ERR(sb);
- out_put:
-        kfree(c);
-        put_mtd_device(mtd);
-
-        return ret;
-}
-
-static int jffs2_get_sb_mtdnr(struct file_system_type *fs_type,
-                              int flags, const char *dev_name,
-                              void *data, int mtdnr,
-                              struct vfsmount *mnt)
-{
-        struct mtd_info *mtd;
-
-        mtd = get_mtd_device(NULL, mtdnr);
-        if (IS_ERR(mtd)) {
-                D1(printk(KERN_DEBUG "jffs2: MTD device #%u doesn't appear to exist\n", mtdnr));
-                return PTR_ERR(mtd);
-        }
-
-        return jffs2_get_sb_mtd(fs_type, flags, dev_name, data, mtd, mnt);
+        return jffs2_do_fill_super(sb, data, silent);
 }
 
 static int jffs2_get_sb(struct file_system_type *fs_type,
                         int flags, const char *dev_name,
                         void *data, struct vfsmount *mnt)
 {
-        int err;
-        struct nameidata nd;
-        int mtdnr;
-
-        if (!dev_name)
-                return -EINVAL;
-
-        D1(printk(KERN_DEBUG "jffs2_get_sb(): dev_name \"%s\"\n", dev_name));
-
-        /* The preferred way of mounting in future; especially when
-           CONFIG_BLK_DEV is implemented - we specify the underlying
-           MTD device by number or by name, so that we don't require
-           block device support to be present in the kernel. */
-
-        /* FIXME: How to do the root fs this way? */
-
-        if (dev_name[0] == 'm' && dev_name[1] == 't' && dev_name[2] == 'd') {
-                /* Probably mounting without the blkdev crap */
-                if (dev_name[3] == ':') {
-                        struct mtd_info *mtd;
-
-                        /* Mount by MTD device name */
-                        D1(printk(KERN_DEBUG "jffs2_get_sb(): mtd:%%s, name \"%s\"\n", dev_name+4));
-                        for (mtdnr = 0; mtdnr < MAX_MTD_DEVICES; mtdnr++) {
-                                mtd = get_mtd_device(NULL, mtdnr);
-                                if (!IS_ERR(mtd)) {
-                                        if (!strcmp(mtd->name, dev_name+4))
-                                                return jffs2_get_sb_mtd(fs_type, flags, dev_name, data, mtd, mnt);
-                                        put_mtd_device(mtd);
-                                }
-                        }
-                        printk(KERN_NOTICE "jffs2_get_sb(): MTD device with name \"%s\" not found.\n", dev_name+4);
-                } else if (isdigit(dev_name[3])) {
-                        /* Mount by MTD device number name */
-                        char *endptr;
-
-                        mtdnr = simple_strtoul(dev_name+3, &endptr, 0);
-                        if (!*endptr) {
-                                /* It was a valid number */
-                                D1(printk(KERN_DEBUG "jffs2_get_sb(): mtd%%d, mtdnr %d\n", mtdnr));
-                                return jffs2_get_sb_mtdnr(fs_type, flags, dev_name, data, mtdnr, mnt);
-                        }
-                }
-        }
-
-        /* Try the old way - the hack where we allowed users to mount
-           /dev/mtdblock$(n) but didn't actually _use_ the blkdev */
-
-        err = path_lookup(dev_name, LOOKUP_FOLLOW, &nd);
-
-        D1(printk(KERN_DEBUG "jffs2_get_sb(): path_lookup() returned %d, inode %p\n",
-                  err, nd.dentry->d_inode));
-
-        if (err)
-                return err;
-
-        err = -EINVAL;
-
-        if (!S_ISBLK(nd.dentry->d_inode->i_mode))
-                goto out;
-
-        if (nd.mnt->mnt_flags & MNT_NODEV) {
-                err = -EACCES;
-                goto out;
-        }
-
-        if (imajor(nd.dentry->d_inode) != MTD_BLOCK_MAJOR) {
-                if (!(flags & MS_SILENT))
-                        printk(KERN_NOTICE "Attempt to mount non-MTD device \"%s\" as JFFS2\n",
-                               dev_name);
-                goto out;
-        }
-
-        mtdnr = iminor(nd.dentry->d_inode);
-        path_release(&nd);
-
-        return jffs2_get_sb_mtdnr(fs_type, flags, dev_name, data, mtdnr, mnt);
-
-out:
-        path_release(&nd);
-        return err;
+        return get_sb_mtd(fs_type, flags, dev_name, data, jffs2_fill_super,
+                          mnt);
 }
 
 static void jffs2_put_super (struct super_block *sb)
@@ -307,8 +152,7 @@ static void jffs2_kill_sb(struct super_block *sb)
         struct jffs2_sb_info *c = JFFS2_SB_INFO(sb);
         if (!(sb->s_flags & MS_RDONLY))
                 jffs2_stop_garbage_collect_thread(c);
-        generic_shutdown_super(sb);
-        put_mtd_device(c->mtd);
+        kill_mtd_super(sb);
         kfree(c);
 }
 
diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
index 78fc08893a6c..e48665984cb3 100644
--- a/fs/jffs2/xattr.c
+++ b/fs/jffs2/xattr.c
@@ -754,6 +754,10 @@ void jffs2_clear_xattr_subsystem(struct jffs2_sb_info *c)
                 list_del(&xd->xindex);
                 jffs2_free_xattr_datum(xd);
         }
+        list_for_each_entry_safe(xd, _xd, &c->xattr_unchecked, xindex) {
+                list_del(&xd->xindex);
+                jffs2_free_xattr_datum(xd);
+        }
 }
 
 #define XREF_TMPHASH_SIZE       (128)
@@ -825,7 +829,7 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
                            ref->xd and ref->ic are not valid yet. */
                         xd = jffs2_find_xattr_datum(c, ref->xid);
                         ic = jffs2_get_ino_cache(c, ref->ino);
-                        if (!xd || !ic) {
+                        if (!xd || !ic || !ic->nlink) {
                                 dbg_xattr("xref(ino=%u, xid=%u, xseqno=%u) is orphan.\n",
                                           ref->ino, ref->xid, ref->xseqno);
                                 ref->xseqno |= XREF_DELETE_MARKER;