Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5c395ae7 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'linux-next' of git://git.infradead.org/ubifs-2.6 

* 'linux-next' of git://git.infradead.org/ubifs-2.6:
  UBI: fix use-after-free on error path
  UBI: fix missing scrub when there is a bit-flip
  UBIFS: Use kmemdup rather than duplicating its implementation
parents 49d41bae e57e0d8e

drivers/mtd/ubi/eba.c

+4 −2
Original line number Diff line number Diff line
@@ -1028,12 +1028,14 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to, 
	 * 'ubi_wl_put_peb()' function on the @ubi->move_mutex. In turn, we are

	 * holding @ubi->move_mutex and go sleep on the LEB lock. So, if the

	 * LEB is already locked, we just do not move it and return

	 * %MOVE_CANCEL_RACE, which means that UBI will re-try, but later.

	 * %MOVE_RETRY. Note, we do not return %MOVE_CANCEL_RACE here because

	 * we do not know the reasons of the contention - it may be just a

	 * normal I/O on this LEB, so we want to re-try.

	 */

	err = leb_write_trylock(ubi, vol_id, lnum);

	if (err) {

		dbg_wl("contention on LEB %d:%d, cancel", vol_id, lnum);

		return MOVE_CANCEL_RACE;

		return MOVE_RETRY;

	}



	/*

drivers/mtd/ubi/ubi.h

+2 −0
Original line number Diff line number Diff line
@@ -120,6 +120,7 @@ enum { 
 *                     PEB

 * MOVE_CANCEL_BITFLIPS: canceled because a bit-flip was detected in the

 *                       target PEB

 * MOVE_RETRY: retry scrubbing the PEB

 */

enum {

	MOVE_CANCEL_RACE = 1,
@@ -127,6 +128,7 @@ enum { 
	MOVE_TARGET_RD_ERR,

	MOVE_TARGET_WR_ERR,

	MOVE_CANCEL_BITFLIPS,

	MOVE_RETRY,

};



/**

drivers/mtd/ubi/wl.c

+8 −4
Original line number Diff line number Diff line
@@ -795,7 +795,10 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, 
			protect = 1;

			goto out_not_moved;

		}



		if (err == MOVE_RETRY) {

			scrubbing = 1;

			goto out_not_moved;

		}

		if (err == MOVE_CANCEL_BITFLIPS || err == MOVE_TARGET_WR_ERR ||

		    err == MOVE_TARGET_RD_ERR) {

			/*
@@ -1049,7 +1052,6 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk, 


	ubi_err("failed to erase PEB %d, error %d", pnum, err);

	kfree(wl_wrk);

	kmem_cache_free(ubi_wl_entry_slab, e);



	if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||

	    err == -EBUSY) {
@@ -1062,14 +1064,16 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk, 
			goto out_ro;

		}

		return err;

	} else if (err != -EIO) {

	}



	kmem_cache_free(ubi_wl_entry_slab, e);

	if (err != -EIO)

		/*

		 * If this is not %-EIO, we have no idea what to do. Scheduling

		 * this physical eraseblock for erasure again would cause

		 * errors again and again. Well, lets switch to R/O mode.

		 */

		goto out_ro;

	}



	/* It is %-EIO, the PEB went bad */

fs/ubifs/lpt.c

+2 −4
Original line number Diff line number Diff line
@@ -1986,12 +1986,11 @@ int ubifs_lpt_scan_nolock(struct ubifs_info *c, int start_lnum, int end_lnum, 


				if (path[h].in_tree)

					continue;

				nnode = kmalloc(sz, GFP_NOFS);

				nnode = kmemdup(&path[h].nnode, sz, GFP_NOFS);

				if (!nnode) {

					err = -ENOMEM;

					goto out;

				}

				memcpy(nnode, &path[h].nnode, sz);

				parent = nnode->parent;

				parent->nbranch[nnode->iip].nnode = nnode;

				path[h].ptr.nnode = nnode;
@@ -2004,12 +2003,11 @@ int ubifs_lpt_scan_nolock(struct ubifs_info *c, int start_lnum, int end_lnum, 
				const size_t sz = sizeof(struct ubifs_pnode);

				struct ubifs_nnode *parent;



				pnode = kmalloc(sz, GFP_NOFS);

				pnode = kmemdup(&path[h].pnode, sz, GFP_NOFS);

				if (!pnode) {

					err = -ENOMEM;

					goto out;

				}

				memcpy(pnode, &path[h].pnode, sz);

				parent = pnode->parent;

				parent->nbranch[pnode->iip].pnode = pnode;

				path[h].ptr.pnode = pnode;

fs/ubifs/tnc.c

+1 −2
Original line number Diff line number Diff line
@@ -344,12 +344,11 @@ static int lnc_add(struct ubifs_info *c, struct ubifs_zbranch *zbr, 
		return err;

	}



	lnc_node = kmalloc(zbr->len, GFP_NOFS);

	lnc_node = kmemdup(node, zbr->len, GFP_NOFS);

	if (!lnc_node)

		/* We don't have to have the cache, so no error */

		return 0;



	memcpy(lnc_node, node, zbr->len);

	zbr->leaf = lnc_node;

	return 0;

}