Merge tag 'for-linus-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw...

Pull JFFS2, UBI and UBIFS updates from Richard Weinberger:
 "JFFS2:
   - Fixes for various memory issues

  UBI:
   - Fix for a race condition in cdev ioctl handler

  UBIFS:
   - Fixes for O_TMPFILE and whiteout handling

   - Fixes for various memory issues"

* tag 'for-linus-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
  ubifs: rename_whiteout: correct old_dir size computing
  jffs2: fix memory leak in jffs2_scan_medium
  jffs2: fix memory leak in jffs2_do_mount_fs
  jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
  fs/jffs2: fix comments mentioning i_mutex
  ubi: fastmap: Return error code if memory allocation fails in add_aeb()
  ubifs: Fix to add refcount once page is set private
  ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()
  ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
  ubifs: Rectify space amount budget for mkdir/tmpfile operations
  ubifs: Fix 'ui->dirty' race between do_tmpfile() and writeback work
  ubifs: Rename whiteout atomically
  ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
  ubifs: Fix wrong number of inodes locked by ui_mutex in ubifs_inode comment
  ubifs: Fix deadlock in concurrent rename whiteout and inode writeback
  ubifs: rename_whiteout: Fix double free for whiteout_ui->data
  ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl

diff --cc fs/ubifs/file.c
index 8a9ffc2d4167aeaceebd0f2b48fda352aa1bd3fc,6b45a037a047120930adbe95320e6416f4cfa758..0383fbdc95ff1d2f199897221215db7a0f2ef97d
--- 1/fs/ubifs/file.c
--- 2/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@@ -1304,8 -1304,8 +1304,8 @@@ static void ubifs_invalidate_folio(stru
                release_existing_page_budget(c);
  
        atomic_long_dec(&c->dirty_pg_cnt);
-       folio_clear_private(folio);
 -      detach_page_private(page);
 -      ClearPageChecked(page);
++      folio_detach_private(folio);
 +      folio_clear_checked(folio);
  }
  
  int ubifs_fsync(struct file *file, loff_t start, loff_t end, int datasync)