13 Jun, 2018

2 commits

  • The vmalloc() function has no 2-factor argument form, so multiplication
    factors need to be wrapped in array_size(). This patch replaces cases of:

    vmalloc(a * b)

    with:
    vmalloc(array_size(a, b))

    as well as handling cases of:

    vmalloc(a * b * c)

    with:

    vmalloc(array3_size(a, b, c))

    This does, however, attempt to ignore constant size factors like:

    vmalloc(4 * 1024)

    though any constants defined via macros get caught up in the conversion.

    Any factors with a sizeof() of "unsigned char", "char", and "u8" were
    dropped, since they're redundant.

    The Coccinelle script used for this was:

    // Fix redundant parens around sizeof().
    @@
    type TYPE;
    expression THING, E;
    @@

    (
    vmalloc(
    - (sizeof(TYPE)) * E
    + sizeof(TYPE) * E
    , ...)
    |
    vmalloc(
    - (sizeof(THING)) * E
    + sizeof(THING) * E
    , ...)
    )

    // Drop single-byte sizes and redundant parens.
    @@
    expression COUNT;
    typedef u8;
    typedef __u8;
    @@

    (
    vmalloc(
    - sizeof(u8) * (COUNT)
    + COUNT
    , ...)
    |
    vmalloc(
    - sizeof(__u8) * (COUNT)
    + COUNT
    , ...)
    |
    vmalloc(
    - sizeof(char) * (COUNT)
    + COUNT
    , ...)
    |
    vmalloc(
    - sizeof(unsigned char) * (COUNT)
    + COUNT
    , ...)
    |
    vmalloc(
    - sizeof(u8) * COUNT
    + COUNT
    , ...)
    |
    vmalloc(
    - sizeof(__u8) * COUNT
    + COUNT
    , ...)
    |
    vmalloc(
    - sizeof(char) * COUNT
    + COUNT
    , ...)
    |
    vmalloc(
    - sizeof(unsigned char) * COUNT
    + COUNT
    , ...)
    )

    // 2-factor product with sizeof(type/expression) and identifier or constant.
    @@
    type TYPE;
    expression THING;
    identifier COUNT_ID;
    constant COUNT_CONST;
    @@

    (
    vmalloc(
    - sizeof(TYPE) * (COUNT_ID)
    + array_size(COUNT_ID, sizeof(TYPE))
    , ...)
    |
    vmalloc(
    - sizeof(TYPE) * COUNT_ID
    + array_size(COUNT_ID, sizeof(TYPE))
    , ...)
    |
    vmalloc(
    - sizeof(TYPE) * (COUNT_CONST)
    + array_size(COUNT_CONST, sizeof(TYPE))
    , ...)
    |
    vmalloc(
    - sizeof(TYPE) * COUNT_CONST
    + array_size(COUNT_CONST, sizeof(TYPE))
    , ...)
    |
    vmalloc(
    - sizeof(THING) * (COUNT_ID)
    + array_size(COUNT_ID, sizeof(THING))
    , ...)
    |
    vmalloc(
    - sizeof(THING) * COUNT_ID
    + array_size(COUNT_ID, sizeof(THING))
    , ...)
    |
    vmalloc(
    - sizeof(THING) * (COUNT_CONST)
    + array_size(COUNT_CONST, sizeof(THING))
    , ...)
    |
    vmalloc(
    - sizeof(THING) * COUNT_CONST
    + array_size(COUNT_CONST, sizeof(THING))
    , ...)
    )

    // 2-factor product, only identifiers.
    @@
    identifier SIZE, COUNT;
    @@

    vmalloc(
    - SIZE * COUNT
    + array_size(COUNT, SIZE)
    , ...)

    // 3-factor product with 1 sizeof(type) or sizeof(expression), with
    // redundant parens removed.
    @@
    expression THING;
    identifier STRIDE, COUNT;
    type TYPE;
    @@

    (
    vmalloc(
    - sizeof(TYPE) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    vmalloc(
    - sizeof(TYPE) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    vmalloc(
    - sizeof(TYPE) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    vmalloc(
    - sizeof(TYPE) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    vmalloc(
    - sizeof(THING) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    vmalloc(
    - sizeof(THING) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    vmalloc(
    - sizeof(THING) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    vmalloc(
    - sizeof(THING) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    )

    // 3-factor product with 2 sizeof(variable), with redundant parens removed.
    @@
    expression THING1, THING2;
    identifier COUNT;
    type TYPE1, TYPE2;
    @@

    (
    vmalloc(
    - sizeof(TYPE1) * sizeof(TYPE2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    vmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    vmalloc(
    - sizeof(THING1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    vmalloc(
    - sizeof(THING1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    vmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    |
    vmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    )

    // 3-factor product, only identifiers, with redundant parens removed.
    @@
    identifier STRIDE, SIZE, COUNT;
    @@

    (
    vmalloc(
    - (COUNT) * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    vmalloc(
    - COUNT * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    vmalloc(
    - COUNT * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    vmalloc(
    - (COUNT) * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    vmalloc(
    - COUNT * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    vmalloc(
    - (COUNT) * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    vmalloc(
    - (COUNT) * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    vmalloc(
    - COUNT * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    )

    // Any remaining multi-factor products, first at least 3-factor products
    // when they're not all constants...
    @@
    expression E1, E2, E3;
    constant C1, C2, C3;
    @@

    (
    vmalloc(C1 * C2 * C3, ...)
    |
    vmalloc(
    - E1 * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    )

    // And then all remaining 2 factors products when they're not all constants.
    @@
    expression E1, E2;
    constant C1, C2;
    @@

    (
    vmalloc(C1 * C2, ...)
    |
    vmalloc(
    - E1 * E2
    + array_size(E1, E2)
    , ...)
    )

    Signed-off-by: Kees Cook

    Kees Cook
     
  • The kmalloc() function has a 2-factor argument form, kmalloc_array(). This
    patch replaces cases of:

    kmalloc(a * b, gfp)

    with:
    kmalloc_array(a * b, gfp)

    as well as handling cases of:

    kmalloc(a * b * c, gfp)

    with:

    kmalloc(array3_size(a, b, c), gfp)

    as it's slightly less ugly than:

    kmalloc_array(array_size(a, b), c, gfp)

    This does, however, attempt to ignore constant size factors like:

    kmalloc(4 * 1024, gfp)

    though any constants defined via macros get caught up in the conversion.

    Any factors with a sizeof() of "unsigned char", "char", and "u8" were
    dropped, since they're redundant.

    The tools/ directory was manually excluded, since it has its own
    implementation of kmalloc().

    The Coccinelle script used for this was:

    // Fix redundant parens around sizeof().
    @@
    type TYPE;
    expression THING, E;
    @@

    (
    kmalloc(
    - (sizeof(TYPE)) * E
    + sizeof(TYPE) * E
    , ...)
    |
    kmalloc(
    - (sizeof(THING)) * E
    + sizeof(THING) * E
    , ...)
    )

    // Drop single-byte sizes and redundant parens.
    @@
    expression COUNT;
    typedef u8;
    typedef __u8;
    @@

    (
    kmalloc(
    - sizeof(u8) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(__u8) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(char) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(unsigned char) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(u8) * COUNT
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(__u8) * COUNT
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(char) * COUNT
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(unsigned char) * COUNT
    + COUNT
    , ...)
    )

    // 2-factor product with sizeof(type/expression) and identifier or constant.
    @@
    type TYPE;
    expression THING;
    identifier COUNT_ID;
    constant COUNT_CONST;
    @@

    (
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * (COUNT_ID)
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * COUNT_ID
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * (COUNT_CONST)
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * COUNT_CONST
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * (COUNT_ID)
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * COUNT_ID
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * (COUNT_CONST)
    + COUNT_CONST, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * COUNT_CONST
    + COUNT_CONST, sizeof(THING)
    , ...)
    )

    // 2-factor product, only identifiers.
    @@
    identifier SIZE, COUNT;
    @@

    - kmalloc
    + kmalloc_array
    (
    - SIZE * COUNT
    + COUNT, SIZE
    , ...)

    // 3-factor product with 1 sizeof(type) or sizeof(expression), with
    // redundant parens removed.
    @@
    expression THING;
    identifier STRIDE, COUNT;
    type TYPE;
    @@

    (
    kmalloc(
    - sizeof(TYPE) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    )

    // 3-factor product with 2 sizeof(variable), with redundant parens removed.
    @@
    expression THING1, THING2;
    identifier COUNT;
    type TYPE1, TYPE2;
    @@

    (
    kmalloc(
    - sizeof(TYPE1) * sizeof(TYPE2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kmalloc(
    - sizeof(THING1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kmalloc(
    - sizeof(THING1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    )

    // 3-factor product, only identifiers, with redundant parens removed.
    @@
    identifier STRIDE, SIZE, COUNT;
    @@

    (
    kmalloc(
    - (COUNT) * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - (COUNT) * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - (COUNT) * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - (COUNT) * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    )

    // Any remaining multi-factor products, first at least 3-factor products,
    // when they're not all constants...
    @@
    expression E1, E2, E3;
    constant C1, C2, C3;
    @@

    (
    kmalloc(C1 * C2 * C3, ...)
    |
    kmalloc(
    - (E1) * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kmalloc(
    - (E1) * (E2) * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kmalloc(
    - (E1) * (E2) * (E3)
    + array3_size(E1, E2, E3)
    , ...)
    |
    kmalloc(
    - E1 * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    )

    // And then all remaining 2 factors products when they're not all constants,
    // keeping sizeof() as the second factor argument.
    @@
    expression THING, E1, E2;
    type TYPE;
    constant C1, C2, C3;
    @@

    (
    kmalloc(sizeof(THING) * C2, ...)
    |
    kmalloc(sizeof(TYPE) * C2, ...)
    |
    kmalloc(C1 * C2 * C3, ...)
    |
    kmalloc(C1 * C2, ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * (E2)
    + E2, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * E2
    + E2, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * (E2)
    + E2, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * E2
    + E2, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - (E1) * E2
    + E1, E2
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - (E1) * (E2)
    + E1, E2
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - E1 * E2
    + E1, E2
    , ...)
    )

    Signed-off-by: Kees Cook

    Kees Cook
     

29 Mar, 2018

1 commit


16 Mar, 2018

2 commits

  • ->fail_addr and ->addr can be updated no matter the result of
    parent->_erase(), we just need to remove the code doing the same thing
    in mtd_erase_callback() to avoid adjusting those fields twice.

    Note that this can be done because all MTD users have been converted to
    not pass an erase_info->callback() and are thus only taking the
    ->addr_fail and ->addr fields into account after part_erase() has
    returned.

    While we're at it, get rid of the erase_info->mtd field which was only
    needed to let mtd_erase_callback() get the partition device back.

    Signed-off-by: Boris Brezillon
    Reviewed-by: Richard Weinberger

    Boris Brezillon
     
  • None of the mtd->_erase() implementations work in an asynchronous manner,
    so let's simplify MTD users that call mtd_erase(). All they need to do
    is check the value returned by mtd_erase() and assume that != 0 means
    failure.

    Signed-off-by: Boris Brezillon
    Reviewed-by: Richard Weinberger

    Boris Brezillon
     

25 Dec, 2016

1 commit


19 Dec, 2015

1 commit


15 Jul, 2014

1 commit

  • I got the following panic on my fsl p5020ds board.

    Unable to handle kernel paging request for data at address 0x7375627379737465
    Faulting instruction address: 0xc000000000100778
    Oops: Kernel access of bad area, sig: 11 [#1]
    SMP NR_CPUS=24 CoreNet Generic
    Modules linked in:
    CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.15.0-next-20140613 #145
    task: c0000000fe080000 ti: c0000000fe088000 task.ti: c0000000fe088000
    NIP: c000000000100778 LR: c00000000010073c CTR: 0000000000000000
    REGS: c0000000fe08aa00 TRAP: 0300 Not tainted (3.15.0-next-20140613)
    MSR: 0000000080029000 CR: 24ad2e24 XER: 00000000
    DEAR: 7375627379737465 ESR: 0000000000000000 SOFTE: 1
    GPR00: c0000000000c99b0 c0000000fe08ac80 c0000000009598e0 c0000000fe001d80
    GPR04: 00000000000000d0 0000000000000913 c000000007902b20 0000000000000000
    GPR08: c0000000feaae888 0000000000000000 0000000007091000 0000000000200200
    GPR12: 0000000028ad2e28 c00000000fff4000 c0000000007abe08 0000000000000000
    GPR16: c0000000007ab160 c0000000007aaf98 c00000000060ba68 c0000000007abda8
    GPR20: c0000000007abde8 c0000000feaea6f8 c0000000feaea708 c0000000007abd10
    GPR24: c000000000989370 c0000000008c6228 00000000000041ed c0000000fe00a400
    GPR28: c00000000017c1cc 00000000000000d0 7375627379737465 c0000000fe001d80
    NIP [c000000000100778] .__kmalloc_track_caller+0x70/0x168
    LR [c00000000010073c] .__kmalloc_track_caller+0x34/0x168
    Call Trace:
    [c0000000fe08ac80] [c00000000087e6b8] uevent_sock_list+0x0/0x10 (unreliable)
    [c0000000fe08ad20] [c0000000000c99b0] .kstrdup+0x44/0x90
    [c0000000fe08adc0] [c00000000017c1cc] .__kernfs_new_node+0x4c/0x130
    [c0000000fe08ae70] [c00000000017d7e4] .kernfs_new_node+0x2c/0x64
    [c0000000fe08aef0] [c00000000017db00] .kernfs_create_dir_ns+0x34/0xc8
    [c0000000fe08af80] [c00000000018067c] .sysfs_create_dir_ns+0x58/0xcc
    [c0000000fe08b010] [c0000000002c711c] .kobject_add_internal+0xc8/0x384
    [c0000000fe08b0b0] [c0000000002c7644] .kobject_add+0x64/0xc8
    [c0000000fe08b140] [c000000000355ebc] .device_add+0x11c/0x654
    [c0000000fe08b200] [c0000000002b5988] .add_disk+0x20c/0x4b4
    [c0000000fe08b2c0] [c0000000003a21d4] .add_mtd_blktrans_dev+0x340/0x514
    [c0000000fe08b350] [c0000000003a3410] .mtdblock_add_mtd+0x74/0xb4
    [c0000000fe08b3e0] [c0000000003a32cc] .blktrans_notify_add+0x64/0x94
    [c0000000fe08b470] [c00000000039b5b4] .add_mtd_device+0x1d4/0x368
    [c0000000fe08b520] [c00000000039b830] .mtd_device_parse_register+0xe8/0x104
    [c0000000fe08b5c0] [c0000000003b8408] .of_flash_probe+0x72c/0x734
    [c0000000fe08b750] [c00000000035ba40] .platform_drv_probe+0x38/0x84
    [c0000000fe08b7d0] [c0000000003599a4] .really_probe+0xa4/0x29c
    [c0000000fe08b870] [c000000000359d3c] .__driver_attach+0x100/0x104
    [c0000000fe08b900] [c00000000035746c] .bus_for_each_dev+0x84/0xe4
    [c0000000fe08b9a0] [c0000000003593c0] .driver_attach+0x24/0x38
    [c0000000fe08ba10] [c000000000358f24] .bus_add_driver+0x1c8/0x2ac
    [c0000000fe08bab0] [c00000000035a3a4] .driver_register+0x8c/0x158
    [c0000000fe08bb30] [c00000000035b9f4] .__platform_driver_register+0x6c/0x80
    [c0000000fe08bba0] [c00000000084e080] .of_flash_driver_init+0x1c/0x30
    [c0000000fe08bc10] [c000000000001864] .do_one_initcall+0xbc/0x238
    [c0000000fe08bd00] [c00000000082cdc0] .kernel_init_freeable+0x188/0x268
    [c0000000fe08bdb0] [c0000000000020a0] .kernel_init+0x1c/0xf7c
    [c0000000fe08be30] [c000000000000884] .ret_from_kernel_thread+0x58/0xd4
    Instruction dump:
    41bd0010 480000c8 4bf04eb5 60000000 e94d0028 e93f0000 7cc95214 e8a60008
    7fc9502a 2fbe0000 419e00c8 e93f0022 39200000 88ed06b2 992d06b2
    ---[ end trace b4c9a94804a42d40 ]---

    It seems that the corrupted partition header on my mtd device triggers
    a bug in the ftl. In function build_maps() it will allocate the buffers
    needed by the mtd partition, but if something goes wrong such as kmalloc
    failure, mtd read error or invalid partition header parameter, it will
    free all allocated buffers and then return non-zero. In my case, it
    seems that partition header parameter 'NumTransferUnits' is invalid.

    And the ftl_freepart() is a function which free all the partition
    buffers allocated by build_maps(). Given the build_maps() is a self
    cleaning function, so there is no need to invoke this function even
    if build_maps() return with error. Otherwise it will causes the
    buffers to be freed twice and then weird things would happen.

    Cc: stable@vger.kernel.org
    Signed-off-by: Kevin Hao
    Signed-off-by: Brian Norris

    Kevin Hao
     

03 Jul, 2014

1 commit


10 Jan, 2012

5 commits


11 Sep, 2011

2 commits

  • Signed-off-by: Brian Norris
    Signed-off-by: Artem Bityutskiy

    Brian Norris
     
  • Start moving away from the MTD_DEBUG_LEVEL messages. The dynamic
    debugging feature is a generic kernel feature that provides more
    flexibility.

    (See Documentation/dynamic-debug-howto.txt)

    Also fix some punctuation, indentation, and capitalization that went
    along with the affected lines.

    Signed-off-by: Brian Norris
    Signed-off-by: Artem Bityutskiy

    Brian Norris
     

18 Oct, 2010

1 commit

  • The patch below updates broken web addresses in the kernel

    Signed-off-by: Justin P. Mattock
    Cc: Maciej W. Rozycki
    Cc: Geert Uytterhoeven
    Cc: Finn Thain
    Cc: Randy Dunlap
    Cc: Matt Turner
    Cc: Dimitry Torokhov
    Cc: Mike Frysinger
    Acked-by: Ben Pfaff
    Acked-by: Hans J. Koch
    Reviewed-by: Finn Thain
    Signed-off-by: Jiri Kosina

    Justin P. Mattock
     

09 Aug, 2010

1 commit


27 Feb, 2010

1 commit

  • * Add locking where it was missing.

    * Don't do a get_mtd_device in blktrans_open because it would lead to a
    deadlock; instead do that in add_mtd_blktrans_dev.

    * Only free the mtd_blktrans_dev structure when the last user exits.

    * Flush request queue on device removal.

    * Track users, and call tr->release in del_mtd_blktrans_dev
    Due to that ->open and release aren't called more that once.

    Now it is safe to call del_mtd_blktrans_dev while the device is still in use.

    Signed-off-by: Maxim Levitsky
    Signed-off-by: David Woodhouse

    Maxim Levitsky
     

21 Sep, 2009

1 commit


10 Dec, 2008

1 commit


09 Oct, 2008

1 commit

  • We can benefit from knowing that the file system no longer cares about
    the contents of certain sectors, by throwing them away immediately and
    then never having to garbage collect them, and using the extra free
    space to make our operations more efficient. Do so.

    Signed-off-by: David Woodhouse
    Signed-off-by: Jens Axboe

    David Woodhouse
     

25 Jul, 2008

1 commit


24 Jun, 2008

1 commit

  • The code in include/pcmcia/bulkmem.h was only kept for compatibility reasons.
    Therefore, move the remaining region_info_t definition to ds.h

    [linux@dominikbrodowski.net: do not modify the IOCTL, move definition to
    ds.h, and update changelog]
    Signed-off-by: Magnus Damm
    Signed-off-by: Dominik Brodowski

    Magnus Damm
     

05 Jun, 2008

1 commit

  • Once upon a time, the MTD repository was using CVS.

    This patch therefore removes all usages of the no longer updated CVS
    keywords from the MTD code.

    This also includes code that printed them to the user.

    Signed-off-by: Adrian Bunk
    Signed-off-by: David Woodhouse

    Adrian Bunk
     

22 Apr, 2008

1 commit


15 Feb, 2007

1 commit

  • After Al Viro (finally) succeeded in removing the sched.h #include in module.h
    recently, it makes sense again to remove other superfluous sched.h includes.
    There are quite a lot of files which include it but don't actually need
    anything defined in there. Presumably these includes were once needed for
    macros that used to live in sched.h, but moved to other header files in the
    course of cleaning it up.

    To ease the pain, this time I did not fiddle with any header files and only
    removed #includes from .c-files, which tend to cause less trouble.

    Compile tested against 2.6.20-rc2 and 2.6.20-rc2-mm2 (with offsets) on alpha,
    arm, i386, ia64, mips, powerpc, and x86_64 with allnoconfig, defconfig,
    allmodconfig, and allyesconfig as well as a few randconfigs on x86_64 and all
    configs in arch/arm/configs on arm. I also checked that no new warnings were
    introduced by the patch (actually, some warnings are removed that were emitted
    by unnecessarily included header files).

    Signed-off-by: Tim Schmielau
    Acked-by: Russell King
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Tim Schmielau
     

29 Nov, 2006

2 commits


30 Nov, 2005

1 commit


07 Nov, 2005

1 commit


11 Sep, 2005

1 commit

  • This patch does a full cleanup of 'NULL checks before vfree', and a partial
    cleanup of calls to kfree for all of drivers/ - the kfree bit is partial in
    that I only did the files that also had vfree calls in them. The patch
    also gets rid of some redundant (void *) casts of pointers being passed to
    [vk]free, and a some tiny whitespace corrections also crept in.

    Signed-off-by: Jesper Juhl
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jesper Juhl
     

23 May, 2005

1 commit


17 Apr, 2005

1 commit

  • Initial git repository build. I'm not bothering with the full history,
    even though we have it. We can create a separate "historical" git
    archive of that later if we want to, and in the meantime it's about
    3.2GB when imported into git - space that would just make the early
    git days unnecessarily complicated, when we don't have a lot of good
    infrastructure for it.

    Let it rip!

    Linus Torvalds