superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/drivers/mtd
History
Zhihao Cheng cc4bc532ac ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed 
[ Upstream commit 4d57a7333e ]

Following process will trigger an infinite loop in ubi_wl_put_peb():

	ubifs_bgt		ubi_bgt
ubifs_leb_unmap
  ubi_leb_unmap
    ubi_eba_unmap_leb
      ubi_wl_put_peb	wear_leveling_worker
                          e1 = rb_entry(rb_first(&ubi->used)
			  e2 = get_peb_for_wl(ubi)
			  ubi_io_read_vid_hdr  // return err (flash fault)
			  out_error:
			    ubi->move_from = ubi->move_to = NULL
			    wl_entry_destroy(ubi, e1)
			      ubi->lookuptbl[e->pnum] = NULL
      retry:
        e = ubi->lookuptbl[pnum];	// return NULL
	if (e == ubi->move_from) {	// NULL == NULL gets true
	  goto retry;			// infinite loop !!!

$ top
  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     COMMAND
  7676 root     20   0       0      0      0 R 100.0  0.0  ubifs_bgt0_0

Fix it by:
 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has
    been removed from 'ubi->lookuptbl'.
 2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an
    use-after-free problem for wl entry in ubi_wl_put_peb().

Fetch a reproducer in [Link].

Fixes: 43f9b25a9c ("UBI: bugfix: protect from volume removal")
Fixes: ee59ba8b06 ("UBI: Fix stale pointers in ubi->lookuptbl")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216111
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2023-03-11 13:55:21 +01:00
..
chips
…
devices mtd: add ECC error accounting for each read request 2022-09-21 10:38:09 +02:00
hyperbus
…
lpddr mtd: lpddr2_nvm: Fix possible null-ptr-deref 2022-12-31 13:32:12 +01:00
maps mtd: maps: pxa2xx-flash: fix memory leak in probe 2022-12-31 13:32:15 +01:00
nand mtd: onenand: omap2: add dependency on GPMC 2022-11-07 16:53:04 +01:00
parsers mtd: parsers: scpart: fix __udivdi3 undefined on mips 2023-01-18 11:58:24 +01:00
spi-nor mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type 2023-03-10 09:34:21 +01:00
tests treewide: use get_random_bytes() when possible 2022-10-11 17:42:58 -06:00
ubi ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed 2023-03-11 13:55:21 +01:00
Kconfig
…
Makefile
…
ftl.c mtd: ftl: use container_of() rather than cast 2022-09-19 18:14:53 +02:00
inftlcore.c mtd: always initialize 'stats' in struct mtd_oob_ops 2022-09-21 10:38:07 +02:00
inftlmount.c
…
mtd_blkdevs.c
…
mtdblock.c
…
mtdblock_ro.c
…
mtdchar.c mtdchar: add MEMREAD ioctl 2022-09-21 10:38:11 +02:00
mtdconcat.c mtd: fix repeated word in comment 2022-09-20 10:40:30 +02:00
mtdcore.c mtd: core: Fix refcount error in del_mtd_device() 2022-12-31 13:32:15 +01:00
mtdcore.h
…
mtdoops.c
…
mtdpart.c mtd: mtdpart: Don't create platform device that'll never probe 2023-03-10 09:33:38 +01:00
mtdpstore.c mtd: Fix a typo in a comment 2022-09-19 18:14:53 +02:00
mtdsuper.c
…
mtdswap.c mtd: always initialize 'stats' in struct mtd_oob_ops 2022-09-21 10:38:07 +02:00
nftlcore.c mtd: always initialize 'stats' in struct mtd_oob_ops 2022-09-21 10:38:07 +02:00
nftlmount.c
…
rfd_ftl.c
…
sm_ftl.c mtd: always initialize 'stats' in struct mtd_oob_ops 2022-09-21 10:38:07 +02:00
sm_ftl.h
…
ssfdc.c mtd: always initialize 'stats' in struct mtd_oob_ops 2022-09-21 10:38:07 +02:00