linux-stable.git/drivers/mtd/ubi, branch v3.19

UBI: Fix invalid vfree()

2014-11-07T13:14:09+00:00

The logic of vfree()'ing vol->upd_buf is tied to vol->updating.
In ubi_start_update() vol->updating is set long before vmalloc()'ing
vol->upd_buf. If we encounter a write failure in ubi_start_update()
before vmalloc() the UBI device release function will try to vfree()
vol->upd_buf because vol->updating is set.
Fix this by allocating vol->upd_buf directly after setting vol->updating.

Fixes:
[   31.559338] UBI warning: vol_cdev_release: update of volume 2 not finished, volume is damaged
[   31.559340] ------------[ cut here ]------------
[   31.559343] WARNING: CPU: 1 PID: 2747 at mm/vmalloc.c:1446 __vunmap+0xe3/0x110()
[   31.559344] Trying to vfree() nonexistent vm area (ffffc90001f2b000)
[   31.559345] Modules linked in:
[   31.565620]  0000000000000bba ffff88002a0cbdb0 ffffffff818f0497 ffff88003b9ba148
[   31.566347]  ffff88002a0cbde0 ffffffff8156f515 ffff88003b9ba148 0000000000000bba
[   31.567073]  0000000000000000 0000000000000000 ffff88002a0cbe88 ffffffff8156c10a
[   31.567793] Call Trace:
[   31.568034]  [] dump_stack+0x4e/0x7a
[   31.568510]  [] ubi_io_write_vid_hdr+0x155/0x160
[   31.569084]  [] ubi_eba_write_leb+0x23a/0x870
[   31.569628]  [] vol_cdev_write+0x226/0x380
[   31.570155]  [] vfs_write+0xb5/0x1f0
[   31.570627]  [] SyS_pwrite64+0x6a/0xa0
[   31.571123]  [] system_call_fastpath+0x16/0x1b

Cc: 
Signed-off-by: Richard Weinberger 
Signed-off-by: Artem Bityutskiy

UBI: Fix double free after do_sync_erase()

2014-11-07T11:42:43+00:00

If the erase worker is unable to erase a PEB it will
free the ubi_wl_entry itself.
The failing ubi_wl_entry must not free()'d again after
do_sync_erase() returns.

Cc: 
Signed-off-by: Richard Weinberger 
Signed-off-by: Artem Bityutskiy

UBI: vtbl: Use ubi_eba_atomic_leb_change()

2014-11-07T10:08:51+00:00

This is more a cosmetic change than a fix.
By using ubi_eba_atomic_leb_change()
we can guarantee that the first VTBL record is always
correct and we don't really need the second one anymore.
But we have to keep the second one to not break anything.

Artem: add a comment

Signed-off-by: Richard Weinberger 
Signed-off-by: Artem Bityutskiy

UBI: Extend UBI layer debug/messaging capabilities

2014-11-07T10:08:51+00:00

If there is more then one UBI device mounted, there is no way to
distinguish between messages from different UBI devices.
Add device number to all ubi layer message types.

The R/O block driver messages were replaced by pr_* since
ubi_device structure is not used by it.

Amended a bit by Artem.

Signed-off-by: Tanya Brokhman 
Signed-off-by: Artem Bityutskiy

UBI: Fastmap: Calc fastmap size correctly

2014-10-03T14:33:28+00:00

We need to add fm_sb too.

Signed-off-by: Richard Weinberger 
Reviewed-by: Tanya Brokhman 
Signed-off-by: Artem Bityutskiy

UBI: Fix trivial typo in __schedule_ubi_work

2014-09-30T06:29:37+00:00

s/of/if/

Signed-off-by: Richard Weinberger 
Signed-off-by: Artem Bityutskiy

UBI: wl: Rename cancel flag to shutdown

2014-09-26T10:43:32+00:00

It confused me more than once that the cancel flag of the
work function does not indicate the cancellation of a single work.
In fact it indicates the WL sub-system shutdown and therefore
worker functions have to free their wl_entries too.
That's why you cannot cancel a single work, you can only shutdown
all works.

Signed-off-by: Richard Weinberger 
Signed-off-by: Artem Bityutskiy

UBI: ubi_eba_read_leb: Remove in vain variable assignment

2014-09-26T10:42:41+00:00

There is no need to set err, it will be overwritten in any case
later at:
        if (scrub)
                err = ubi_wl_scrub_peb(ubi, pnum);

Signed-off-by: Richard Weinberger 
Signed-off-by: Artem Bityutskiy

UBI: Fix livelock in produce_free_peb()

2014-09-24T12:36:16+00:00

The while loop in produce_free_peb() assumes that each work will produce a
free PEB. This is not true.
If ubi->works_count is 1 and the only scheduled work is the
wear_leveling_worker() produce_free_peb() can loop forever in case
nobody schedules an erase work.
Fix this issue by checking in the while loop whether work is scheduled.

Signed-off-by: Richard Weinberger 
Signed-off-by: Artem Bityutskiy

UBI: return on error in rename_volumes()

2014-09-19T15:12:00+00:00

I noticed this during a code review.  We are checking that the strlen()
of ->name is not less than the ->name_len which the user gave us.  I
believe this bug is harmless but clearly we meant to return here instead
of setting an error code and then not using it.

Signed-off-by: Dan Carpenter 
Signed-off-by: Artem Bityutskiy