JFFS2: fix mount crash caused by removed nodes
authorThomas Gleixner <tglx@linutronix.de>
Mon, 16 Feb 2009 20:29:31 +0000 (21:29 +0100)
committerGreg Kroah-Hartman <gregkh@suse.de>
Tue, 17 Mar 2009 00:52:44 +0000 (17:52 -0700)
commit662f8bb08ee7875c6f25047256b2336104e3e98f
treeadb684f2db6545a82107d40ee2eb77d1a7ed567c
parentfbb38fcb8e793f5df68be9992354d9d50cbd41ea
JFFS2: fix mount crash caused by removed nodes

commit 4c41bd0ec953954158f92bed5d3062645062b98e upstream.

At scan time we observed following scenario:

   node A inserted
   node B inserted
   node C inserted -> sets overlapped flag on node B

   node A is removed due to CRC failure -> overlapped flag on node B remains

   while (tn->overlapped)
     tn = tn_prev(tn);

   ==> crash, when tn_prev(B) is referenced.

When the ultimate node is removed at scan time and the overlapped flag
is set on the penultimate node, then nothing updates the overlapped
flag of that node. The overlapped iterators blindly expect that the
ultimate node does not have the overlapped flag set, which causes the
scan code to crash.

It would be a huge overhead to go through the node chain on node
removal and fix up the overlapped flags, so detecting such a case on
the fly in the overlapped iterators is a simpler and reliable
solution.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
fs/jffs2/readinode.c