yaffs direct: Fix bounds issue in handle to pointer function

[yaffs2.git] / yaffs_summary.c

diff --git a/yaffs_summary.c b/yaffs_summary.c
index 31d443a872710fec5ff406892579ad4bc2608dc5..4cf171117766db42f27330030ae4035b7a19a8c4 100644 (file)
--- a/yaffs_summary.c
+++ b/yaffs_summary.c
@@ -11,18 +11,16 @@
  * published by the Free Software Foundation.
  */
 
-/* Summaries write all the tags for the chunks in a block into packed tags
- * (just the tags part - no ECC) in the last n chunks of the block.
+/* Summaries write the useful part of the tags for the chunks in a block into an
+ * an array which is written to the last n chunks of the block.
  * Reading the summaries gives all the tags for the block in one read. Much
  * faster.
  *
  * Chunks holding summaries are marked with tags making it look like
  * they are part of a fake file.
  *
- * The chunks that hold the summary are removed from free space and are marked
- * as being in use.
+ * The summary could also be used during gc.
  *
- * THa above might need to be revisited.
  */
 
 #include "yaffs_summary.h"
@@ -31,7 +29,7 @@
 #include "yaffs_getblockinfo.h"
 #include "yaffs_bitmap.h"
 
-/* Summary tags don't need the sequence number becase that is redundant. */
+/* Summary tags don't need the sequence number because that is redundant. */
 struct yaffs_summary_tags {
        unsigned obj_id;
        unsigned chunk_id;
@@ -76,8 +74,8 @@ void yaffs_summary_deinit(struct yaffs_dev *dev)
 {
        kfree(dev->sum_tags);
        dev->sum_tags = NULL;
-       kfree(dev->sum_tags);
-       dev->sum_tags = NULL;
+       kfree(dev->gc_sum_tags);
+       dev->gc_sum_tags = NULL;
        dev->chunks_per_summary = 0;
 }
 
@@ -98,7 +96,7 @@ static int yaffs_summary_write(struct yaffs_dev *dev, int blk)
        memset(&tags, 0, sizeof(struct yaffs_ext_tags));
        tags.obj_id = YAFFS_OBJECTID_SUMMARY;
        tags.chunk_id = 1;
-       chunk_in_block = dev-> chunks_per_summary;
+       chunk_in_block = dev->chunks_per_summary;
        chunk_in_nand = dev->alloc_block * dev->param.chunks_per_block +
                                                dev-> chunks_per_summary;
        do {
@@ -121,8 +119,6 @@ static int yaffs_summary_write(struct yaffs_dev *dev, int blk)
                chunk_in_nand++;
                chunk_in_block++;
                tags.chunk_id++;
-
-               chunk_in_block++;
        } while (result == YAFFS_OK && n_bytes > 0);
        yaffs_release_temp_buffer(dev, buffer);
 
@@ -245,6 +241,12 @@ void yaffs_summary_gc(struct yaffs_dev *dev, int blk)
        if (!bi->has_summary)
                return;
 
-       for (i = dev->chunks_per_summary; i < dev->param.chunks_per_block; i++)
-               yaffs_clear_chunk_bit(dev, blk, i);
+       for (i = dev->chunks_per_summary; i < dev->param.chunks_per_block; i++) {
+               if( yaffs_check_chunk_bit(dev, blk, i)) {
+                       yaffs_clear_chunk_bit(dev, blk, i);
+                       bi->pages_in_use--;
+                       dev->n_free_chunks++;
+               }
+       }
+
 }