Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bb7d43b1 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'upstream-3.14-rc5' of git://git.infradead.org/linux-ubifs 

Pull ubifs fix from Artem Bityutskiy:
 "Just a single fix for the UBI module unload path which makes sure we
  do not touch freed memory"

* tag 'upstream-3.14-rc5' of git://git.infradead.org/linux-ubifs:
  UBI: fix some use after free bugs
parents d2a04763 5547fec7

drivers/mtd/ubi/fastmap.c

+4 −4
Original line number Diff line number Diff line
@@ -463,8 +463,8 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai, 
				}

			}

			if (found_orphan) {

				kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

				list_del(&tmp_aeb->u.list);

				kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

			}



			new_aeb = kmem_cache_alloc(ai->aeb_slab_cache,
@@ -846,16 +846,16 @@ fail_bad: 
	ret = UBI_BAD_FASTMAP;

fail:

	list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &used, u.list) {

		kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

		list_del(&tmp_aeb->u.list);

		kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

	}

	list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &eba_orphans, u.list) {

		kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

		list_del(&tmp_aeb->u.list);

		kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

	}

	list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &free, u.list) {

		kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

		list_del(&tmp_aeb->u.list);

		kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

	}



	return ret;