kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers/mtd/ubi
History
Zhihao Cheng 3afaaf6f58 ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed 
[ Upstream commit 4d57a7333e ]

Following process will trigger an infinite loop in ubi_wl_put_peb():

	ubifs_bgt		ubi_bgt
ubifs_leb_unmap
  ubi_leb_unmap
    ubi_eba_unmap_leb
      ubi_wl_put_peb	wear_leveling_worker
                          e1 = rb_entry(rb_first(&ubi->used)
			  e2 = get_peb_for_wl(ubi)
			  ubi_io_read_vid_hdr  // return err (flash fault)
			  out_error:
			    ubi->move_from = ubi->move_to = NULL
			    wl_entry_destroy(ubi, e1)
			      ubi->lookuptbl[e->pnum] = NULL
      retry:
        e = ubi->lookuptbl[pnum];	// return NULL
	if (e == ubi->move_from) {	// NULL == NULL gets true
	  goto retry;			// infinite loop !!!

$ top
  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     COMMAND
  7676 root     20   0       0      0      0 R 100.0  0.0  ubifs_bgt0_0

Fix it by:
 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has
    been removed from 'ubi->lookuptbl'.
 2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an
    use-after-free problem for wl entry in ubi_wl_put_peb().

Fetch a reproducer in [Link].

Fixes: 43f9b25a9c ("UBI: bugfix: protect from volume removal")
Fixes: ee59ba8b06 ("UBI: Fix stale pointers in ubi->lookuptbl")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216111
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-03-11 13:57:26 +01:00
..
attach.c mtd: Convert fallthrough comments into statements 2020-03-30 10:14:54 +02:00
block.c ubi: use blk_mq_alloc_disk and blk_cleanup_disk 2021-06-11 11:54:43 -06:00
build.c ubi: Fix possible null-ptr-deref in ubi_free_volume() 2023-03-11 13:57:25 +01:00
cdev.c compat_ioctl: move drivers to compat_ptr_ioctl 2019-10-23 17:23:43 +02:00
debug.c ubifs: fix snprintf() checking 2021-06-18 22:04:47 +02:00
debug.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
eba.c ubi: eba: Delete useless kfree code 2021-02-12 21:53:22 +01:00
fastmap-wl.c ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap 2023-03-11 13:57:25 +01:00
fastmap.c ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty 2022-06-14 18:36:10 +02:00
gluebi.c mtd: ubi: gluebi: Fix misnamed function parameter documentation 2020-11-20 12:37:32 +01:00
io.c ubi: remove dead code in validate_vid_hdr() 2021-02-12 21:53:22 +01:00
kapi.c mtd: ubi: kapi: Correct documentation for 'ubi_leb_read_sg's 'sgl' parameter 2020-11-20 12:37:31 +01:00
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
misc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
ubi-media.h ubi: ubi-media.h: Replace zero-length array with flexible-array member 2020-03-30 23:02:37 +02:00
ubi.h ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty 2022-06-14 18:36:10 +02:00
upd.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
vmt.c ubi: Fix possible null-ptr-deref in ubi_free_volume() 2023-03-11 13:57:25 +01:00
vtbl.c ubi: Free the normal volumes in error paths of ubi_attach_mtd_dev() 2020-01-16 23:35:59 +01:00
wl.c ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed 2023-03-11 13:57:26 +01:00
wl.h ubi: Fix producing anchor PEBs 2019-11-17 22:45:57 +01:00