JFFS2: locking fixes

We weren't correctly holding a lock when adding raw nodes to the 
per-inode list.
Signed-off-by: Artem Bityuckiy <dedekind@infradead.org>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

fs/jffs2/gc.c

@@ -7,7 +7,7 @@
  *
  * For licensing information, see the file 'LICENCE' in this directory.
  *
- * $Id: gc.c,v 1.137 2004/07/20 13:44:55 dwmw2 Exp $
+ * $Id: gc.c,v 1.140 2004/11/13 10:59:22 dedekind Exp $
  *
  */
 
@@ -628,6 +628,7 @@ static int jffs2_garbage_collect_pristine(struct jffs2_sb_info *c,
 			jffs2_free_raw_node_ref(nraw);
 		}
 
+		jffs2_free_raw_node_ref(nraw);
 		if (!ret)
 			ret = -EIO;
 		goto out_node;
@@ -637,10 +638,12 @@ static int jffs2_garbage_collect_pristine(struct jffs2_sb_info *c,
 
 	/* Link into per-inode list. This is safe because of the ic
 	   state being INO_STATE_GC. Note that if we're doing this
-	   for an inode which is in-code, the 'nraw' pointer is then
+	   for an inode which is in-core, the 'nraw' pointer is then
 	   going to be fetched from ic->nodes by our caller. */
+	spin_lock(&c->erase_completion_lock);
         nraw->next_in_ino = ic->nodes;
         ic->nodes = nraw;
+	spin_unlock(&c->erase_completion_lock);
 
 	jffs2_mark_node_obsolete(c, raw);
 	D1(printk(KERN_DEBUG "WHEEE! GC REF_PRISTINE node at 0x%08x succeeded\n", ref_offset(raw)));

fs/jffs2/write.c

@@ -7,7 +7,7 @@
  *
  * For licensing information, see the file 'LICENCE' in this directory.
  *
- * $Id: write.c,v 1.85 2004/07/13 08:58:25 dwmw2 Exp $
+ * $Id: write.c,v 1.86 2004/11/13 10:44:26 dedekind Exp $
  *
  */
 
@@ -213,8 +213,10 @@ struct jffs2_full_dnode *jffs2_write_dnode(struct jffs2_sb_info *c, struct jffs2
 	jffs2_add_physical_node_ref(c, raw);
 
 	/* Link into per-inode list */
+	spin_lock(&c->erase_completion_lock);
 	raw->next_in_ino = f->inocache->nodes;
 	f->inocache->nodes = raw;
+	spin_unlock(&c->erase_completion_lock);
 
 	D1(printk(KERN_DEBUG "jffs2_write_dnode wrote node at 0x%08x(%d) with dsize 0x%x, csize 0x%x, node_crc 0x%08x, data_crc 0x%08x, totlen 0x%08x\n",
 		  flash_ofs, ref_flags(raw), je32_to_cpu(ri->dsize), 
@@ -333,8 +335,10 @@ struct jffs2_full_dirent *jffs2_write_dirent(struct jffs2_sb_info *c, struct jff
 	raw->flash_offset |= REF_PRISTINE;
 	jffs2_add_physical_node_ref(c, raw);
 
+	spin_lock(&c->erase_completion_lock);
 	raw->next_in_ino = f->inocache->nodes;
 	f->inocache->nodes = raw;
+	spin_unlock(&c->erase_completion_lock);
 
 	if (retried) {
 		ACCT_SANITY_CHECK(c,NULL);