* [PATCH] ubi: eba: properly rollback inside self_check_eba
@ 2024-02-29 20:42 Fedor Pchelkin
2024-03-01 1:23 ` Zhihao Cheng
0 siblings, 1 reply; 2+ messages in thread
From: Fedor Pchelkin @ 2024-02-29 20:42 UTC (permalink / raw)
To: Richard Weinberger
Cc: Fedor Pchelkin, Miquel Raynal, Vignesh Raghavendra,
Artem Bityutskiy, linux-mtd, linux-kernel, Alexey Khoroshilov,
lvc-project, stable
In case of a memory allocation failure in the volumes loop we can only
process the already allocated scan_eba and fm_eba array elements on the
error path - others are still uninitialized.
Found by Linux Verification Center (linuxtesting.org).
Fixes: 00abf3041590 ("UBI: Add self_check_eba()")
Cc: stable@vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
---
drivers/mtd/ubi/eba.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index 8d1f0e05892c..6f5eadb1598d 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -1557,6 +1557,7 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
GFP_KERNEL);
if (!fm_eba[i]) {
ret = -ENOMEM;
+ kfree(scan_eba[i]);
goto out_free;
}
@@ -1592,7 +1593,7 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
}
out_free:
- for (i = 0; i < num_volumes; i++) {
+ while (--i >= 0) {
if (!ubi->volumes[i])
continue;
--
2.43.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ubi: eba: properly rollback inside self_check_eba
2024-02-29 20:42 [PATCH] ubi: eba: properly rollback inside self_check_eba Fedor Pchelkin
@ 2024-03-01 1:23 ` Zhihao Cheng
0 siblings, 0 replies; 2+ messages in thread
From: Zhihao Cheng @ 2024-03-01 1:23 UTC (permalink / raw)
To: Fedor Pchelkin, Richard Weinberger
Cc: Miquel Raynal, Vignesh Raghavendra, Artem Bityutskiy, linux-mtd,
linux-kernel, Alexey Khoroshilov, lvc-project, stable
在 2024/3/1 4:42, Fedor Pchelkin 写道:
> In case of a memory allocation failure in the volumes loop we can only
> process the already allocated scan_eba and fm_eba array elements on the
> error path - others are still uninitialized.
>
> Found by Linux Verification Center (linuxtesting.org).
>
> Fixes: 00abf3041590 ("UBI: Add self_check_eba()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
> ---
> drivers/mtd/ubi/eba.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
>
> diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
> index 8d1f0e05892c..6f5eadb1598d 100644
> --- a/drivers/mtd/ubi/eba.c
> +++ b/drivers/mtd/ubi/eba.c
> @@ -1557,6 +1557,7 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
> GFP_KERNEL);
> if (!fm_eba[i]) {
> ret = -ENOMEM;
> + kfree(scan_eba[i]);
> goto out_free;
> }
>
> @@ -1592,7 +1593,7 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
> }
>
> out_free:
> - for (i = 0; i < num_volumes; i++) {
> + while (--i >= 0) {
> if (!ubi->volumes[i])
> continue;
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-03-01 1:24 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-02-29 20:42 [PATCH] ubi: eba: properly rollback inside self_check_eba Fedor Pchelkin
2024-03-01 1:23 ` Zhihao Cheng
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).