From patchwork Tue Oct 7 17:29:04 2008 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Rosenthal X-Patchwork-Id: 3259 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from bombadil.infradead.org (bombadil.infradead.org [18.85.46.34]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 5D5C1DDE41 for ; Wed, 8 Oct 2008 16:28:05 +1100 (EST) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.68 #1 (Red Hat Linux)) id 1KnRQB-0003kp-J8; Wed, 08 Oct 2008 05:17:15 +0000 Received: from smtpout.cs.fsu.edu ([128.186.122.75] helo=mail.cs.fsu.edu) by bombadil.infradead.org with esmtp (Exim 4.68 #1 (Red Hat Linux)) id 1KnGo4-0003hS-DA for linux-mtd@lists.infradead.org; Tue, 07 Oct 2008 17:57:13 +0000 Received: from cs.fsu.edu (www.cs.fsu.edu [192.168.23.10]) by mail.cs.fsu.edu (Postfix) with ESMTP id 1E7C6F292F; Tue, 7 Oct 2008 13:31:01 -0400 (EDT) Received: from odo.cs.fsu.edu (odo.cs.fsu.edu [192.168.122.93]) by system.cs.fsu.edu (Horde MIME library) with HTTP; Tue, 7 Oct 2008 13:29:04 -0400 Message-ID: <20081007132904.6vvmlioy8co004ko@system.cs.fsu.edu> Date: Tue, 7 Oct 2008 13:29:04 -0400 From: Daniel Rosenthal To: gerg@snapgear.com, dwmw2@infradead.org Subject: [PATCH (fixed)] Fix infinite loop in INFTL_foldchain() in drivers/mtd/inftlcore.c MIME-Version: 1.0 User-Agent: Internet Messaging Program (IMP) H3 (4.1.3) X-Spam-Score: 1.8 (+) X-Spam-Report: SpamAssassin version 3.2.5 on bombadil.infradead.org summary: Content analysis details: (1.8 points) pts rule name description ---- ---------------------- -------------------------------------------------- 1.8 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars X-Mailman-Approved-At: Wed, 08 Oct 2008 01:17:13 -0400 Cc: linux-mtd@lists.infradead.org X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-mtd-bounces@lists.infradead.org Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org I'm having problems with my email client, but I've attached a patch (both inline and as a regular attachment). This patch fixes a loop that is potentially infinite in INFTL_foldchain in drivers/mtd/inftlcore.c. When iterating over a chain in reverse (oldest block first), this patch correctly marks the PUtable[] entry of the second to last erase block of a chain as BLOCK_NIL, regardless of whether or not it can format the last block successfully. Before, the second to last block was only marked as pointing to BLOCK_NIL if INFTL_formatblock() succeeded on the last block of the chain, which could potentially result in an infinite loop if the block was worn out and refused to format. If there are any problems with this patch please let me know. I can apply them fine after pulling them from email, but my email client (web interface) isn't fullproof, so if anybody else has problems, please let me know. (I can't send it through pine or otherwise due to network configuration.) Thanks, Daniel ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. >From 8f1275749768d316788194cc198093b00f85d0d6 Mon Sep 17 00:00:00 2001 From: Daniel Rosenthal Date: Sun, 5 Oct 2008 17:43:10 -0400 Subject: [PATCH] Fix infinite loop in INFTL_foldchain in drivers/mtd/inftlcore.c. Signed-off-by: Daniel Rosenthal Acked-by: Greg Ungerer --- drivers/mtd/inftlcore.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c index c4f9d33..50ce138 100644 --- a/drivers/mtd/inftlcore.c +++ b/drivers/mtd/inftlcore.c @@ -388,6 +388,10 @@ static u16 INFTL_foldchain(struct INFTLrecord *inftl, unsigned thisVUC, unsigned if (thisEUN == targetEUN) break; + /* Unlink the last block from the chain. */ + inftl->PUtable[prevEUN] = BLOCK_NIL; + + /* Now try to erase it. */ if (INFTL_formatblock(inftl, thisEUN) < 0) { /* * Could not erase : mark block as reserved. @@ -396,7 +400,6 @@ static u16 INFTL_foldchain(struct INFTLrecord *inftl, unsigned thisVUC, unsigned } else { /* Correctly erased : mark it as free */ inftl->PUtable[thisEUN] = BLOCK_FREE; - inftl->PUtable[prevEUN] = BLOCK_NIL; inftl->numfreeEUNs++; } }