Patchwork UBI: fix a horrible memory deallocation bug

login
register
mail settings
Submitter Artem Bityutskiy
Date Sept. 3, 2012, 2:25 p.m.
Message ID <1346682356-14997-1-git-send-email-dedekind1@gmail.com>
Download mbox | patch
Permalink /patch/181368/
State New
Headers show

Comments

Artem Bityutskiy - Sept. 3, 2012, 2:25 p.m.
From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>

UBI was mistakingly using 'kfree()' instead of 'kmem_cache_free()' when
freeing "attach eraseblock" structures in vtbl.c. Thankfully, this happened
only when we were doing auto-format, so many systems were unaffected. However,
there are still many users affected.

It is strange, but the system did not crash and nothing bad happened when
the SLUB memory allocator was used. However, in case of SLOB we observed an
crash right away.

This problem was introduced in 2.6.39 by commit
"6c1e875 UBI: add slab cache for ubi_scan_leb objects"

Reported-by: Richard Genoud <richard.genoud@gmail.com>
Cc: stable@vger.kernel.org [v2.6.39+]
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
---
 drivers/mtd/ubi/vtbl.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
Richard Genoud - Sept. 3, 2012, 2:43 p.m.
2012/9/3 Artem Bityutskiy <dedekind1@gmail.com>:
> From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
>
> UBI was mistakingly using 'kfree()' instead of 'kmem_cache_free()' when
> freeing "attach eraseblock" structures in vtbl.c. Thankfully, this happened
> only when we were doing auto-format, so many systems were unaffected. However,
> there are still many users affected.
>
> It is strange, but the system did not crash and nothing bad happened when
> the SLUB memory allocator was used. However, in case of SLOB we observed an
> crash right away.
>
> This problem was introduced in 2.6.39 by commit
> "6c1e875 UBI: add slab cache for ubi_scan_leb objects"
>
> Reported-by: Richard Genoud <richard.genoud@gmail.com>
> Cc: stable@vger.kernel.org [v2.6.39+]
> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
> ---
>  drivers/mtd/ubi/vtbl.c |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
Tested ok, works like a charm !
Thanks !

Patch

diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
index 64b9c56..926e3df 100644
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -340,7 +340,7 @@  retry:
 	 * of this LEB as it will be deleted and freed in 'ubi_add_to_av()'.
 	 */
 	err = ubi_add_to_av(ubi, ai, new_aeb->pnum, new_aeb->ec, vid_hdr, 0);
-	kfree(new_aeb);
+	kmem_cache_free(ai->aeb_slab_cache, new_aeb);
 	ubi_free_vid_hdr(ubi, vid_hdr);
 	return err;
 
@@ -353,7 +353,7 @@  write_error:
 		list_add(&new_aeb->u.list, &ai->erase);
 		goto retry;
 	}
-	kfree(new_aeb);
+	kmem_cache_free(ai->aeb_slab_cache, new_aeb);
 out_free:
 	ubi_free_vid_hdr(ubi, vid_hdr);
 	return err;