A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-06 20:03:33 -04:00
Code Issues Projects Releases Packages Wiki Activity
android_kernel_motorola_sm6375/drivers/mtd
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Zhihao Cheng b5be23f6ae ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed 
[ Upstream commit 4d57a7333e26040f2b583983e1970d9d460e56b0 ]

Following process will trigger an infinite loop in ubi_wl_put_peb():

	ubifs_bgt		ubi_bgt
ubifs_leb_unmap
  ubi_leb_unmap
    ubi_eba_unmap_leb
      ubi_wl_put_peb	wear_leveling_worker
                          e1 = rb_entry(rb_first(&ubi->used)
			  e2 = get_peb_for_wl(ubi)
			  ubi_io_read_vid_hdr  // return err (flash fault)
			  out_error:
			    ubi->move_from = ubi->move_to = NULL
			    wl_entry_destroy(ubi, e1)
			      ubi->lookuptbl[e->pnum] = NULL
      retry:
        e = ubi->lookuptbl[pnum];	// return NULL
	if (e == ubi->move_from) {	// NULL == NULL gets true
	  goto retry;			// infinite loop !!!

$ top
  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     COMMAND
  7676 root     20   0       0      0      0 R 100.0  0.0  ubifs_bgt0_0

Fix it by:
 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has
    been removed from 'ubi->lookuptbl'.
 2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an
    use-after-free problem for wl entry in ubi_wl_put_peb().

Fetch a reproducer in [Link].

Fixes: 43f9b25a9c ("UBI: bugfix: protect from volume removal")
Fixes: ee59ba8b06 ("UBI: Fix stale pointers in ubi->lookuptbl")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216111
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-11 16:44:10 +01:00
..
chips mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N 2022-06-14 18:12:03 +02:00
devices mtd: devices: docg3: check the return value of devm_ioremap() in the probe 2022-10-26 13:22:37 +02:00
hyperbus
lpddr mtd: lpddr2_nvm: Fix possible null-ptr-deref 2023-01-18 11:41:03 +01:00
maps mtd: maps: pxa2xx-flash: fix memory leak in probe 2023-01-18 11:41:05 +01:00
nand mtd: rawnand: sunxi: Fix the size of the last OOB region 2023-03-11 16:43:50 +01:00
parsers mtd: partitions: Fix refcount leak in parse_redboot_of 2022-08-25 11:17:51 +02:00
spi-nor mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() 2023-01-18 11:41:49 +01:00
tests
ubi ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed 2023-03-11 16:44:10 +01:00
ftl.c
inftlcore.c
inftlmount.c
Kconfig
Makefile
mtd_blkdevs.c
mtdblock.c
mtdblock_ro.c
mtdchar.c mtd: require write permissions for locking and badblock ioctls 2021-05-14 09:44:19 +02:00
mtdconcat.c
mtdcore.c mtd: Fix device name leak when register device failed in add_mtd_device() 2023-01-18 11:41:02 +01:00
mtdcore.h
mtdoops.c
mtdpart.c
mtdsuper.c
mtdswap.c
nftlcore.c
nftlmount.c
rfd_ftl.c
sm_ftl.c mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release 2022-08-25 11:17:51 +02:00
sm_ftl.h
ssfdc.c