| Message ID | 20230504025354.3595768-2-wangzhaolong1@huawei.com |
|---|---|
| State | New |
| Delegated to: | Richard Weinberger |
| Headers | show |
| Series | [-next,V2,1/2] ubi: fix slab-out-of-bounds in ubi_eba_get_ldesc+0xfb/0x130 | expand |
在 2023/5/4 10:53, ZhaoLong Wang 写道: > In the error handing path `out_acc` of the ubi_resize_volume(), > when `pebs < 0`, it means that the volume table record fails to be > updated when the volume is shrinked. In this case, the number of > ubi->avail_pebs` and `ubi->rsvd_pebs` should also be restored, > otherwise the UBI will display an incorrect number of available PEBs. > > Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com> > --- > drivers/mtd/ubi/vmt.c | 9 ++++----- > 1 file changed, 4 insertions(+), 5 deletions(-) > Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com> > diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c > index 97294def01eb..990571287e84 100644 > --- a/drivers/mtd/ubi/vmt.c > +++ b/drivers/mtd/ubi/vmt.c > @@ -515,13 +515,12 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs) > out_acc: > spin_lock(&ubi->volumes_lock); > vol->reserved_pebs = reserved_pebs - pebs; > - if (pebs > 0) { > - ubi->rsvd_pebs -= pebs; > - ubi->avail_pebs += pebs; > + ubi->rsvd_pebs -= pebs; > + ubi->avail_pebs += pebs; > + if (pebs > 0) > ubi_eba_copy_table(vol, old_eba_tbl, vol->reserved_pebs); > - } else { > + else > ubi_eba_copy_table(vol, old_eba_tbl, reserved_pebs); > - } > vol->eba_tbl = old_eba_tbl; > spin_unlock(&ubi->volumes_lock); > out_free: >
diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c index 97294def01eb..990571287e84 100644 --- a/drivers/mtd/ubi/vmt.c +++ b/drivers/mtd/ubi/vmt.c @@ -515,13 +515,12 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs) out_acc: spin_lock(&ubi->volumes_lock); vol->reserved_pebs = reserved_pebs - pebs; - if (pebs > 0) { - ubi->rsvd_pebs -= pebs; - ubi->avail_pebs += pebs; + ubi->rsvd_pebs -= pebs; + ubi->avail_pebs += pebs; + if (pebs > 0) ubi_eba_copy_table(vol, old_eba_tbl, vol->reserved_pebs); - } else { + else ubi_eba_copy_table(vol, old_eba_tbl, reserved_pebs); - } vol->eba_tbl = old_eba_tbl; spin_unlock(&ubi->volumes_lock); out_free:
In the error handing path `out_acc` of the ubi_resize_volume(), when `pebs < 0`, it means that the volume table record fails to be updated when the volume is shrinked. In this case, the number of ubi->avail_pebs` and `ubi->rsvd_pebs` should also be restored, otherwise the UBI will display an incorrect number of available PEBs. Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com> --- drivers/mtd/ubi/vmt.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)