Commit 78b495c3 authored by Artem Bityutskiy's avatar Artem Bityutskiy

UBI: fix a horrible memory deallocation bug

UBI was mistakingly using 'kfree()' instead of 'kmem_cache_free()' when
freeing "attach eraseblock" structures in vtbl.c. Thankfully, this happened
only when we were doing auto-format, so many systems were unaffected. However,
there are still many users affected.

It is strange, but the system did not crash and nothing bad happened when
the SLUB memory allocator was used. However, in case of SLOB we observed an
crash right away.

This problem was introduced in 2.6.39 by commit
"6c1e875c UBI: add slab cache for ubi_scan_leb objects"

A note for stable trees:
  Because variable were renamed, this won't cleanly apply to older kernels.
  Changing names like this should help:
	1. ai -> si
	2. aeb_slab_cache -> seb_slab_cache
	3. new_aeb -> new_seb
Reported-by: default avatarRichard Genoud <richard.genoud@gmail.com>
Tested-by: default avatarRichard Genoud <richard.genoud@gmail.com>
Tested-by: default avatarArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
Cc: stable@vger.kernel.org [v2.6.39+]
Signed-off-by: default avatarArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
parent 4cbe5a55
...@@ -340,7 +340,7 @@ static int create_vtbl(struct ubi_device *ubi, struct ubi_attach_info *ai, ...@@ -340,7 +340,7 @@ static int create_vtbl(struct ubi_device *ubi, struct ubi_attach_info *ai,
* of this LEB as it will be deleted and freed in 'ubi_add_to_av()'. * of this LEB as it will be deleted and freed in 'ubi_add_to_av()'.
*/ */
err = ubi_add_to_av(ubi, ai, new_aeb->pnum, new_aeb->ec, vid_hdr, 0); err = ubi_add_to_av(ubi, ai, new_aeb->pnum, new_aeb->ec, vid_hdr, 0);
kfree(new_aeb); kmem_cache_free(ai->aeb_slab_cache, new_aeb);
ubi_free_vid_hdr(ubi, vid_hdr); ubi_free_vid_hdr(ubi, vid_hdr);
return err; return err;
...@@ -353,7 +353,7 @@ static int create_vtbl(struct ubi_device *ubi, struct ubi_attach_info *ai, ...@@ -353,7 +353,7 @@ static int create_vtbl(struct ubi_device *ubi, struct ubi_attach_info *ai,
list_add(&new_aeb->u.list, &ai->erase); list_add(&new_aeb->u.list, &ai->erase);
goto retry; goto retry;
} }
kfree(new_aeb); kmem_cache_free(ai->aeb_slab_cache, new_aeb);
out_free: out_free:
ubi_free_vid_hdr(ubi, vid_hdr); ubi_free_vid_hdr(ubi, vid_hdr);
return err; return err;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment