2024-02-29 21:04:02

by Fedor Pchelkin

Subject: [PATCH] ubi: eba: properly rollback inside self_check_eba

In case of a memory allocation failure in the volumes loop we can only
process the already allocated scan_eba and fm_eba array elements on the
error path - others are still uninitialized.

Found by Linux Verification Center (linuxtesting.org).

Fixes: 00abf3041590 ("UBI: Add self_check_eba()")
Cc: [email protected]
Signed-off-by: Fedor Pchelkin <[email protected]>
---
drivers/mtd/ubi/eba.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index 8d1f0e05892c..6f5eadb1598d 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -1557,6 +1557,7 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
GFP_KERNEL);
if (!fm_eba[i]) {
ret = -ENOMEM;
+ kfree(scan_eba[i]);
goto out_free;
}

@@ -1592,7 +1593,7 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
}

out_free:
- for (i = 0; i < num_volumes; i++) {
+ while (--i >= 0) {
if (!ubi->volumes[i])
continue;

--
2.43.2

2024-03-01 01:24:13

by Zhihao Cheng

Subject: Re: [PATCH] ubi: eba: properly rollback inside self_check_eba

?? 2024/3/1 4:42, Fedor Pchelkin д??:
> In case of a memory allocation failure in the volumes loop we can only
> process the already allocated scan_eba and fm_eba array elements on the
> error path - others are still uninitialized.
>
> Found by Linux Verification Center (linuxtesting.org).
>
> Fixes: 00abf3041590 ("UBI: Add self_check_eba()")
> Cc: [email protected]
> Signed-off-by: Fedor Pchelkin <[email protected]>
> ---
> drivers/mtd/ubi/eba.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)

Reviewed-by: Zhihao Cheng <[email protected]>
>
> diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
> index 8d1f0e05892c..6f5eadb1598d 100644
> --- a/drivers/mtd/ubi/eba.c
> +++ b/drivers/mtd/ubi/eba.c
> @@ -1557,6 +1557,7 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
> GFP_KERNEL);
> if (!fm_eba[i]) {
> ret = -ENOMEM;
> + kfree(scan_eba[i]);
> goto out_free;
> }
>
> @@ -1592,7 +1593,7 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
> }
>
> out_free:
> - for (i = 0; i < num_volumes; i++) {
> + while (--i >= 0) {
> if (!ubi->volumes[i])
> continue;
>
>