linux-stable.git/drivers/mtd/ubi, branch v5.7

ubi: Fix seq_file usage in detailed_erase_block_info debugfs file

2020-05-17T21:38:21+00:00

3bfa7e141b0b ("fs/seq_file.c: seq_read(): add info message about buggy .next functions")
showed that we don't use seq_file correctly.
So make sure that our ->next function always updates the position.

Fixes: 7bccd12d27b7 ("ubi: Add debugfs file for tracking PEB state")
Signed-off-by: Richard Weinberger

Merge tag 'for-linus-5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs

2020-04-07T19:40:56+00:00

Pull UBI and UBIFS updates from Richard Weinberger:

 - Fix for memory leaks around UBIFS orphan handling

 - Fix for memory leaks around UBI fastmap

 - Remove zero-length array from ubi-media.h

 - Fix for TNC lookup in UBIFS orphan code

* tag 'for-linus-5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
  ubi: ubi-media.h: Replace zero-length array with flexible-array member
  ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len
  ubi: fastmap: Only produce the initial anchor PEB when fastmap is used
  ubi: fastmap: Free unused fastmap anchor peb during detach
  ubifs: ubifs_add_orphan: Fix a memory leak bug
  ubifs: ubifs_jnl_write_inode: Fix a memory leak bug
  ubifs: Fix ubifs_tnc_lookup() usage in do_kill_orphans()

ubi: ubi-media.h: Replace zero-length array with flexible-array member

2020-03-30T21:02:37+00:00

The current codebase makes use of the zero-length array language
extension to the C90 standard, but the preferred mechanism to declare
variable-length types such as these ones is a flexible array member[1][2],
introduced in C99:

struct foo {
        int stuff;
        struct boo array[];
};

By making use of the mechanism above, we will get a compiler warning
in case the flexible array does not occur last in the structure, which
will help us prevent some kind of undefined behavior bugs from being
inadvertently introduced[3] to the codebase from now on.

Also, notice that, dynamic memory allocations won't be affected by
this change:

"Flexible array members have incomplete type, and so the sizeof operator
may not be applied. As a quirk of the original implementation of
zero-length arrays, sizeof evaluates to zero."[1]

This issue was found with the help of Coccinelle.

[1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html
[2] https://github.com/KSPP/linux/issues/21
[3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour")

Signed-off-by: Gustavo A. R. Silva 
Signed-off-by: Richard Weinberger

ubi: fastmap: Only produce the initial anchor PEB when fastmap is used

2020-03-30T21:02:36+00:00

Don't produce the initial anchor PEB when ubi device is read-only
or fastmap is disabled, else the resulting PEB will be unusable
to any volume.

Signed-off-by: Hou Tao 
Signed-off-by: Richard Weinberger

ubi: fastmap: Free unused fastmap anchor peb during detach

2020-03-30T21:02:35+00:00

When CONFIG_MTD_UBI_FASTMAP is enabled, fm_anchor will be assigned
a free PEB during ubi_wl_init() or ubi_update_fastmap(). However
if fastmap is not used or disabled on the MTD device, ubi_wl_entry
related with the PEB will not be freed during detach.

So Fix it by freeing the unused fastmap anchor during detach.

Fixes: f9c34bb52997 ("ubi: Fix producing anchor PEBs")
Reported-by: syzbot+f317896aae32eb281a58@syzkaller.appspotmail.com
Reviewed-by: Sascha Hauer 
Signed-off-by: Hou Tao 
Signed-off-by: Richard Weinberger

mtd: Convert fallthrough comments into statements

2020-03-30T08:14:54+00:00

Use Joe Perches cvt_fallthrough.pl script to convert

	/* fallthrough */

comments (and its derivatives) into a

	fallthrough;

statement. This automatically drops useless ones.

Do it MTD-wide.

Signed-off-by: Miquel Raynal 
Acked-by: Vignesh Raghavendra 
Acked-by: Tudor Ambarus 
Acked-by: Richard Weinberger 
Link: https://lore.kernel.org/linux-mtd/20200325212115.14170-1-miquel.raynal@bootlin.com

treewide: remove redundant IS_ERR() before error code check

2020-02-04T03:05:27+00:00

'PTR_ERR(p) == -E*' is a stronger condition than IS_ERR(p).
Hence, IS_ERR(p) is unneeded.

The semantic patch that generates this commit is as follows:

// 
@@
expression ptr;
constant error_code;
@@
-IS_ERR(ptr) && (PTR_ERR(ptr) == - error_code)
+PTR_ERR(ptr) == - error_code
// 

Link: http://lkml.kernel.org/r/20200106045833.1725-1-masahiroy@kernel.org
Signed-off-by: Masahiro Yamada 
Cc: Julia Lawall 
Acked-by: Stephen Boyd  [drivers/clk/clk.c]
Acked-by: Bartosz Golaszewski  [GPIO]
Acked-by: Wolfram Sang  [drivers/i2c]
Acked-by: Rafael J. Wysocki  [acpi/scan.c]
Acked-by: Rob Herring 
Cc: Eric Biggers 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ubi: Fix an error pointer dereference in error handling code

2020-01-19T22:23:28+00:00

If "seen_pebs = init_seen(ubi);" fails then "seen_pebs" is an error pointer
and we try to kfree() it which results in an Oops.

This patch re-arranges the error handling so now it only frees things
which have been allocated successfully.

Fixes: daef3dd1f0ae ("UBI: Fastmap: Add self check to detect absent PEBs")
Signed-off-by: Dan Carpenter 
Signed-off-by: Richard Weinberger

ubi: Free the normal volumes in error paths of ubi_attach_mtd_dev()

2020-01-16T22:35:59+00:00

The allocated normal volumes saved in ubi->volumes are not freed
in the error paths in ubi_attach_mtd_dev() and its callees (e.g.
ubi_attach() and ubi_read_volume_table()).

These normal volumes should be freed through kill_volumes() and
vol_release(), but ubi_attach_mtd_dev() may fail before
calling uif_init(), and there will be memory leaks.

So adding a new helper ubi_free_all_volumes() to free the normal
and the internal volumes. And in order to prevent double-free
of volume, reset ubi->volumes[i] to NULL after freeing.

Signed-off-by: Hou Tao 
Signed-off-by: Richard Weinberger

ubi: Check the presence of volume before call ubi_fastmap_destroy_checkmap()

2020-01-16T22:35:48+00:00

Else there may be oops when fastmap is enabled and init_volumes() fails.

Signed-off-by: Hou Tao 
Signed-off-by: Richard Weinberger