UBIFS: fix crash on error path

This patch fixes a regression introduced by
"4994297 UBIFS: make ubifs_lpt_init clean-up in case of failure" which
I've hit while running the 'integck -p' test. When remount the file-system
from R/O mode to R/W mode and 'lpt_init_wr()' fails, we free _all_ LPT
resources by calling 'ubifs_lpt_free(c, 0)', even those needed for R/O
mode. This leads to subsequent crashes, e.g., if we try to unmount
the file-system.

Cc: stable@vger.kernel.org [v3.5+]
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>

diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index ce33b2beb151f92ac61e51dcefc47cd25ee8dd15..8640920766ed461896add49f69b9db767aa9569c 100644 (file)
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -1749,7 +1749,10 @@ int ubifs_lpt_init(struct ubifs_info *c, int rd, int wr)
        return 0;
 
 out_err:
-       ubifs_lpt_free(c, 0);
+       if (wr)
+               ubifs_lpt_free(c, 1);
+       if (rd)
+               ubifs_lpt_free(c, 0);
        return err;
 }