kernel.git/drivers/mtd/ubi/eba.c, branch linux-4.0.y

UBI: fix out of bounds write

2015-05-06T20:03:52Z

commit d74adbdb9abf0d2506a6c4afa534d894f28b763f upstream. If aeb->len >= vol->reserved_pebs, we should not be writing aeb into the PEB->LEB mapping. Caught by Coverity, CID #711212. Signed-off-by: Brian Norris Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman

UBI: fix missing brace control flow

2015-02-23T21:17:24Z

commit 0e707ae79ba3 ("UBI: do propagate positive error codes up") seems to have produced an unintended change in the control flow here. Completely untested, but it looks obvious. Caught by Coverity, which didn't like the indentation. CID 1271184. Signed-off-by: Brian Norris Cc: Dan Carpenter Signed-off-by: Richard Weinberger

UBI: do propagate positive error codes up

2015-01-28T15:09:25Z

UBI uses positive function return codes internally, and should not propagate them up, except in the place this path fixes. Here is the original bug report from Dan Carpenter: The problem is really in ubi_eba_read_leb(). drivers/mtd/ubi/eba.c 412 err = ubi_io_read_vid_hdr(ubi, pnum, vid_hdr, 1); 413 if (err && err != UBI_IO_BITFLIPS) { 414 if (err > 0) { 415 /* 416 * The header is either absent or corrupted. 417 * The former case means there is a bug - 418 * switch to read-only mode just in case. 419 * The latter case means a real corruption - we 420 * may try to recover data. FIXME: but this is 421 * not implemented. 422 */ 423 if (err == UBI_IO_BAD_HDR_EBADMSG || 424 err == UBI_IO_BAD_HDR) { 425 ubi_warn("corrupted VID header at PEB %d, LEB %d:%d", 426 pnum, vol_id, lnum); 427 err = -EBADMSG; 428 } else 429 ubi_ro_mode(ubi); On this path we return UBI_IO_FF and UBI_IO_FF_BITFLIPS and it eventually gets passed to ERR_PTR(). We probably dereference the bad pointer and oops. At that point we've gone read only so it was already a bad situation... 430 } 431 goto out_free; 432 } else if (err == UBI_IO_BITFLIPS) 433 scrub = 1; 434 Reported-by: Dan Carpenter Signed-off-by: Artem Bityutskiy

UBI: Add initial support for scatter gather

2015-01-28T15:04:26Z

Adds a new set of functions to deal with scatter gather. ubi_eba_read_leb_sg() will read from a LEB into a scatter gather list. The new data structure struct ubi_sgl will be used within UBI to hold the scatter gather list itself and metadata to have a cursor within the list. Signed-off-by: Richard Weinberger Tested-by: Ezequiel Garcia Reviewed-by: Ezequiel Garcia

UBI: Extend UBI layer debug/messaging capabilities

2014-11-07T10:08:51Z

If there is more then one UBI device mounted, there is no way to distinguish between messages from different UBI devices. Add device number to all ubi layer message types. The R/O block driver messages were replaced by pr_* since ubi_device structure is not used by it. Amended a bit by Artem. Signed-off-by: Tanya Brokhman Signed-off-by: Artem Bityutskiy

UBI: ubi_eba_read_leb: Remove in vain variable assignment

2014-09-26T10:42:41Z

There is no need to set err, it will be overwritten in any case later at: if (scrub) err = ubi_wl_scrub_peb(ubi, pnum); Signed-off-by: Richard Weinberger Signed-off-by: Artem Bityutskiy

UBI: Wire-up ->fm_sem

2012-10-03T09:29:37Z

Fastmap uses ->fm_sem to stop EBA changes while writing a new fastmap. Signed-off-by: Richard Weinberger Signed-off-by: Artem Bityutskiy

UBI: Add self_check_eba()

2012-10-03T09:29:37Z

self_check_eba() compares two ubi_attach_info objects. Fastmap uses this function for self checks. Signed-off-by: Richard Weinberger Signed-off-by: Artem Bityutskiy

UBI: Export next_sqnum()

2012-10-03T09:29:37Z

Fastmap needs next_sqnum(), rename it to ubi_next_sqnum() and make it non-static. Signed-off-by: Richard Weinberger Signed-off-by: Artem Bityutskiy

UBI: comply with coding style

2012-09-04T06:39:01Z

Join all the split printk lines in order to stop checkpatch complaining. Signed-off-by: Artem Bityutskiy