From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Thu, 31 Mar 2022 23:09:41 +0000 (-0700)
Subject: Merge tag 'for-linus-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw... 
X-Git-Tag: v5.18-rc1~38
X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=a87a08e3bf2decaed29c4dfde3916676f9b966a8;p=linux-block.git

Merge tag 'for-linus-5.18-rc1' of git://git./linux/kernel/git/rw/ubifs

Pull JFFS2, UBI and UBIFS updates from Richard Weinberger:
 "JFFS2:
   - Fixes for various memory issues

  UBI:
   - Fix for a race condition in cdev ioctl handler

  UBIFS:
   - Fixes for O_TMPFILE and whiteout handling

   - Fixes for various memory issues"

* tag 'for-linus-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
  ubifs: rename_whiteout: correct old_dir size computing
  jffs2: fix memory leak in jffs2_scan_medium
  jffs2: fix memory leak in jffs2_do_mount_fs
  jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
  fs/jffs2: fix comments mentioning i_mutex
  ubi: fastmap: Return error code if memory allocation fails in add_aeb()
  ubifs: Fix to add refcount once page is set private
  ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()
  ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
  ubifs: Rectify space amount budget for mkdir/tmpfile operations
  ubifs: Fix 'ui->dirty' race between do_tmpfile() and writeback work
  ubifs: Rename whiteout atomically
  ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
  ubifs: Fix wrong number of inodes locked by ui_mutex in ubifs_inode comment
  ubifs: Fix deadlock in concurrent rename whiteout and inode writeback
  ubifs: rename_whiteout: Fix double free for whiteout_ui->data
  ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
---

a87a08e3bf2decaed29c4dfde3916676f9b966a8
diff --cc fs/ubifs/file.c
index 8a9ffc2d4167,6b45a037a047..0383fbdc95ff
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@@ -1304,8 -1304,8 +1304,8 @@@ static void ubifs_invalidate_folio(stru
  		release_existing_page_budget(c);
  
  	atomic_long_dec(&c->dirty_pg_cnt);
- 	folio_clear_private(folio);
 -	detach_page_private(page);
 -	ClearPageChecked(page);
++	folio_detach_private(folio);
 +	folio_clear_checked(folio);
  }
  
  int ubifs_fsync(struct file *file, loff_t start, loff_t end, int datasync)