• Richard Weinberger's avatar
    UBI: Fix invalid vfree() · 83e1f583
    Richard Weinberger authored
    commit f38aed97 upstream.
    
    The logic of vfree()'ing vol->upd_buf is tied to vol->updating.
    In ubi_start_update() vol->updating is set long before vmalloc()'ing
    vol->upd_buf. If we encounter a write failure in ubi_start_update()
    before vmalloc() the UBI device release function will try to vfree()
    vol->upd_buf because vol->updating is set.
    Fix this by allocating vol->upd_buf directly after setting vol->updating.
    
    Fixes:
    [   31.559338] UBI warning: vol_cdev_release: update of volume 2 not finished, volume is damaged
    [   31.559340] ------------[ cut here ]------------
    [   31.559343] WARNING: CPU: 1 PID: 2747 at mm/vmalloc.c:1446 __vunmap+0xe3/0x110()
    [   31.559344] Trying to vfree() nonexistent vm area (ffffc90001f2b000)
    [   31.559345] Modules linked in:
    [   31.565620]  0000000000000bba ffff88002a0cbdb0 ffffffff818f0497 ffff88003b9ba148
    [   31.566347]  ffff88002a0cbde0 ffffffff8156f515 ffff88003b9ba148 0000000000000bba
    [   31.567073]  0000000000000000 0000000000000000 ffff88002a0cbe88 ffffffff8156c10a
    [   31.567793] Call Trace:
    [   31.568034]  [<ffffffff818f0497>] dump_stack+0x4e/0x7a
    [   31.568510]  [<ffffffff8156f515>] ubi_io_write_vid_hdr+0x155/0x160
    [   31.569084]  [<ffffffff8156c10a>] ubi_eba_write_leb+0x23a/0x870
    [   31.569628]  [<ffffffff81569b36>] vol_cdev_write+0x226/0x380
    [   31.570155]  [<ffffffff81179265>] vfs_write+0xb5/0x1f0
    [   31.570627]  [<ffffffff81179f8a>] SyS_pwrite64+0x6a/0xa0
    [   31.571123]  [<ffffffff818fde12>] system_call_fastpath+0x16/0x1b
    Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
    Signed-off-by: default avatarArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
    83e1f583
upd.c 12.7 KB