linux-stable.git/drivers/mtd/ubi, branch v3.10.76

UBI: Fix double free after do_sync_erase()

2015-01-16T14:59:01+00:00

commit aa5ad3b6eb8feb2399a5d26c8fb0060561bb9534 upstream.

If the erase worker is unable to erase a PEB it will
free the ubi_wl_entry itself.
The failing ubi_wl_entry must not free()'d again after
do_sync_erase() returns.

Signed-off-by: Richard Weinberger 
Signed-off-by: Artem Bityutskiy 
Signed-off-by: Greg Kroah-Hartman

UBI: Fix invalid vfree()

2015-01-16T14:59:01+00:00

commit f38aed975c0c3645bbdfc5ebe35726e64caaf588 upstream.

The logic of vfree()'ing vol->upd_buf is tied to vol->updating.
In ubi_start_update() vol->updating is set long before vmalloc()'ing
vol->upd_buf. If we encounter a write failure in ubi_start_update()
before vmalloc() the UBI device release function will try to vfree()
vol->upd_buf because vol->updating is set.
Fix this by allocating vol->upd_buf directly after setting vol->updating.

Fixes:
[   31.559338] UBI warning: vol_cdev_release: update of volume 2 not finished, volume is damaged
[   31.559340] ------------[ cut here ]------------
[   31.559343] WARNING: CPU: 1 PID: 2747 at mm/vmalloc.c:1446 __vunmap+0xe3/0x110()
[   31.559344] Trying to vfree() nonexistent vm area (ffffc90001f2b000)
[   31.559345] Modules linked in:
[   31.565620]  0000000000000bba ffff88002a0cbdb0 ffffffff818f0497 ffff88003b9ba148
[   31.566347]  ffff88002a0cbde0 ffffffff8156f515 ffff88003b9ba148 0000000000000bba
[   31.567073]  0000000000000000 0000000000000000 ffff88002a0cbe88 ffffffff8156c10a
[   31.567793] Call Trace:
[   31.568034]  [] dump_stack+0x4e/0x7a
[   31.568510]  [] ubi_io_write_vid_hdr+0x155/0x160
[   31.569084]  [] ubi_eba_write_leb+0x23a/0x870
[   31.569628]  [] vol_cdev_write+0x226/0x380
[   31.570155]  [] vfs_write+0xb5/0x1f0
[   31.570627]  [] SyS_pwrite64+0x6a/0xa0
[   31.571123]  [] system_call_fastpath+0x16/0x1b

Signed-off-by: Richard Weinberger 
Signed-off-by: Artem Bityutskiy 
Signed-off-by: Greg Kroah-Hartman

UBI: add missing kmem_cache_free() in process_pool_aeb error path

2014-11-14T16:47:55+00:00

commit 1bf1890e86869032099b539bc83b098be12fc5a7 upstream.

I ran into this error after a ubiupdatevol, because I forgot to backport
e9110361a9a4 UBI: fix the volumes tree sorting criteria.

UBI error: process_pool_aeb: orphaned volume in fastmap pool
UBI error: ubi_scan_fastmap: Attach by fastmap failed, doing a full scan!
kmem_cache_destroy ubi_ainf_peb_slab: Slab cache still has objects
CPU: 0 PID: 1 Comm: swapper Not tainted 3.14.18-00053-gf05cac8dbf85 #1
[] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[] (show_stack) from [] (destroy_ai+0x230/0x244)
[] (destroy_ai) from [] (ubi_attach+0x98/0x1ec)
[] (ubi_attach) from [] (ubi_attach_mtd_dev+0x2b8/0x868)
[] (ubi_attach_mtd_dev) from [] (ubi_init+0x1dc/0x2ac)
[] (ubi_init) from [] (do_one_initcall+0x94/0x140)
[] (do_one_initcall) from [] (kernel_init_freeable+0xe8/0x1b0)
[] (kernel_init_freeable) from [] (kernel_init+0x8/0xe4)
[] (kernel_init) from [] (ret_from_fork+0x14/0x24)
UBI: scanning is finished

Freeing the cache in the error path fixes the Slab error.

Tested on at91sam9g35 (3.14.18+fastmap backports)

Signed-off-by: Richard Genoud 
Signed-off-by: Greg Kroah-Hartman

UBI: Fix PEB leak in wear_leveling_worker()

2013-09-27T00:18:01+00:00

commit 5ef4414f4bc26a19cfd5cd11aee9697a863e4d51 upstream.

get_peb_for_wl() removes the PEB from the free list.
If the WL subsystem detects that no wear leveling is needed
it cancels the operation and drops the gained PEB.
In this case we have to put the PEB back into the free list.

This issue was introduced with commit ed4b7021c
(UBI: remove PEB from free tree in get_peb_for_wl()).

Signed-off-by: Richard Weinberger 
Signed-off-by: Artem Bityutskiy 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'for-linus-20130301' of git://git.infradead.org/linux-mtd

2013-03-03T00:33:54+00:00

Pull MTD update from David Woodhouse:
 "Fairly unexciting MTD merge for 3.9:

   - misc clean-ups in the MTD command-line partitioning parser
     (cmdlinepart)
   - add flash locking support for STmicro chips serial flash chips, as
     well as for CFI command set 2 chips.
   - new driver for the ELM error correction HW module found in various
     TI chips, enable the OMAP NAND driver to use the ELM HW error
     correction
   - added number of new serial flash IDs
   - various fixes and improvements in the gpmi NAND driver
   - bcm47xx NAND driver improvements
   - make the mtdpart module actually removable"

* tag 'for-linus-20130301' of git://git.infradead.org/linux-mtd: (45 commits)
  mtd: map: BUG() in non handled cases
  mtd: bcm47xxnflash: use pr_fmt for module prefix in messages
  mtd: davinci_nand: Use managed resources
  mtd: mtd_torturetest can cause stack overflows
  mtd: physmap_of: Convert device allocation to managed devm_kzalloc()
  mtd: at91: atmel_nand: for PMECC, add code to check the ONFI parameter ECC requirement.
  mtd: atmel_nand: make pmecc-cap, pmecc-sector-size in dts is optional.
  mtd: atmel_nand: avoid to report an error when lookup table offset is 0.
  mtd: bcm47xxsflash: adjust names of bus-specific functions
  mtd: bcm47xxpart: improve probing of nvram partition
  mtd: bcm47xxpart: add support for other erase sizes
  mtd: bcm47xxnflash: register this as normal driver
  mtd: bcm47xxnflash: fix message
  mtd: bcm47xxsflash: register this as normal driver
  mtd: bcm47xxsflash: write number of written bytes
  mtd: gpmi: add sanity check for the ECC
  mtd: gpmi: set the Golois Field bit for mx6q's BCH
  mtd: devices: elm: Removes  literals in elm DT node
  mtd: gpmi: fix a dereferencing freed memory error
  mtd: fix the wrong timeo for panic_nand_wait()
  ...

new helper: file_inode(file)

2013-02-23T04:31:31+00:00

Signed-off-by: Al Viro

mtd: rename random32() to prandom_u32()

2013-02-04T07:26:28+00:00

Use more preferable function name which implies using a pseudo-random
number generator.

Signed-off-by: Akinobu Mita 
Signed-off-by: Artem Bityutskiy

Merge tag 'upstream-3.8-rc1' of git://git.infradead.org/linux-ubi

2012-12-20T15:39:03+00:00

Pull UBI update from Artem Bityutskiy:
 "Nothing exciting, just clean-ups and nicification.  Oh, and one small
  optimization which makes UBI to use less RAM."

* tag 'upstream-3.8-rc1' of git://git.infradead.org/linux-ubi:
  UBI: embed ubi_debug_info field in ubi_device struct
  UBI: introduce helpers dbg_chk_{io, gen}
  UBI: replace memcpy with struct assignment
  UBI: remove spurious comment
  UBI: gluebi: rename misleading variables
  UBI: do not allocate the memory unnecessarily
  UBI: use list_move_tail instead of list_del/list_add_tail

UBI: embed ubi_debug_info field in ubi_device struct

2012-12-10T11:38:59+00:00

ubi_debug_info struct was dynamically allocated which
is always suboptimal, for it tends to fragment memory
and make the code error-prone.
Fix this by embedding it in ubi_device struct.

Signed-off-by: Ezequiel Garcia 
Signed-off-by: Artem Bityutskiy

UBI: introduce helpers dbg_chk_{io, gen}

2012-12-10T11:38:59+00:00

With this patch code is a bit more readable and there's no
generated code or functionality impact.
Furthermore, this abstracts implementation details and
will allow to change ubi_debug_info in a less invasive way.

Signed-off-by: Ezequiel Garcia 
Signed-off-by: Artem Bityutskiy