iMX/i2som-imx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

UBI: fix a horrible memory deallocation bug

Browse Source 
commit 78b495c39a upstream.

UBI was mistakingly using 'kfree()' instead of 'kmem_cache_free()' when
freeing "attach eraseblock" structures in vtbl.c. Thankfully, this happened
only when we were doing auto-format, so many systems were unaffected. However,
there are still many users affected.

It is strange, but the system did not crash and nothing bad happened when
the SLUB memory allocator was used. However, in case of SLOB we observed an
crash right away.

This problem was introduced in 2.6.39 by commit
"6c1e875 UBI: add slab cache for ubi_scan_leb objects"

A note for stable trees:
  Because variable were renamed, this won't cleanly apply to older kernels.
  Changing names like this should help:
	1. ai -> si
	2. aeb_slab_cache -> seb_slab_cache
	3. new_aeb -> new_seb

Reported-by: Richard Genoud <richard.genoud@gmail.com>
Tested-by: Richard Genoud <richard.genoud@gmail.com>
Tested-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
[bwh: Backported to 3.2: aeb_slab_cache was actually named scan_leb_slab]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This commit is contained in:
Artem Bityutskiy
2012-09-03 17:12:29 +03:00
committed by Ben Hutchings
parent 33c5063fd1
commit 7b07c2bc55
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/mtd/ubi/vtbl.c
View File

@ -346,7 +346,7 @@ retry:
*/
err = ubi_scan_add_used(ubi, si, new_seb->pnum, new_seb->ec,
vid_hdr, 0);
kfree(new_seb);
kmem_cache_free(si->scan_leb_slab, new_seb);
ubi_free_vid_hdr(ubi, vid_hdr);
return err;
@ -359,7 +359,7 @@ write_error:
list_add(&new_seb->u.list, &si->erase);
goto retry;
}
kfree(new_seb);
kmem_cache_free(si->scan_leb_slab, new_seb);
out_free:
ubi_free_vid_hdr(ubi, vid_hdr);
return err;