From 01ebc12f5f2e88a1c6a5436b71a506ac2bf66d6b Mon Sep 17 00:00:00 2001
From: Julia Lawall
Date: Sat, 7 Aug 2010 11:09:29 +0200
Subject: UBI: eliminate update of list_for_each_entry loop cursor
list_for_each_entry uses its first argument to move from one element to the
next, so modifying it can break the iteration. The variable re1 is already
used within the loop as a temporary variable, and is not live here.
The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)
//
@r@
iterator name list_for_each_entry;
expression x,E;
position p1,p2;
@@
list_for_each_entry@p1(x,...) { <... x =@p2 E ...> }
@@
expression x,E;
position r.p1,r.p2;
statement S;
@@
*x =@p2 E
...
list_for_each_entry@p1(x,...) S
//
Signed-off-by: Julia Lawall
Signed-off-by: Artem Bityutskiy
---
drivers/mtd/ubi/cdev.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
(limited to 'drivers')
diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
index 4dfa6b90c21c..3d2d1a69e9a0 100644
--- a/drivers/mtd/ubi/cdev.c
+++ b/drivers/mtd/ubi/cdev.c
@@ -798,18 +798,18 @@ static int rename_volumes(struct ubi_device *ubi,
goto out_free;
}
- re = kzalloc(sizeof(struct ubi_rename_entry), GFP_KERNEL);
- if (!re) {
+ re1 = kzalloc(sizeof(struct ubi_rename_entry), GFP_KERNEL);
+ if (!re1) {
err = -ENOMEM;
ubi_close_volume(desc);
goto out_free;
}
- re->remove = 1;
- re->desc = desc;
- list_add(&re->list, &rename_list);
+ re1->remove = 1;
+ re1->desc = desc;
+ list_add(&re1->list, &rename_list);
dbg_msg("will remove volume %d, name \"%s\"",
- re->desc->vol->vol_id, re->desc->vol->name);
+ re1->desc->vol->vol_id, re1->desc->vol->name);
}
mutex_lock(&ubi->device_mutex);
--
cgit v1.2.3
From 80c1c16fb89e7055acb560e6d90c881b5c7496c1 Mon Sep 17 00:00:00 2001
From: Artem Bityutskiy
Date: Sat, 28 Aug 2010 12:11:40 +0300
Subject: UBI: fix forward compatibility
Commit 0798cea8c2e1afee59686c51d27d0e96b05e42d1 "UBI: improve corrupted flash handling"
broke delet-compatible volumes handling - it introduced a limit of 8 eraseblocks which
may be corrupted. And delete-compatible eraseblocks are added to the "corrupted" list,
so if we'd have a large delete-compatible volume, UBI would refuse it.
The fix is to add delete-compatible volumes to the erase list instead. Indeed, they are
corrupted, we just have to erase them.
Signed-off-by: Artem Bityutskiy
---
drivers/mtd/ubi/scan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
(limited to 'drivers')
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index 372a15ac9995..69b52e9c9489 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -843,7 +843,7 @@ static int process_eb(struct ubi_device *ubi, struct ubi_scan_info *si,
case UBI_COMPAT_DELETE:
ubi_msg("\"delete\" compatible internal volume %d:%d"
" found, will remove it", vol_id, lnum);
- err = add_to_list(si, pnum, ec, &si->corr);
+ err = add_to_list(si, pnum, ec, &si->erase);
if (err)
return err;
return 0;
--
cgit v1.2.3
From 1deacd7a1d4bb22f812908c34e3254de76e4faa8 Mon Sep 17 00:00:00 2001
From: Randy Dunlap
Date: Thu, 12 Aug 2010 12:10:59 -0700
Subject: UBI: fix kconfig unmet dependency
warning: (OPTPROBES && KPROBES && HAVE_OPTPROBES && !PREEMPT && DEBUG_KERNEL ||
MTD_UBI_DEBUG && MTD && SYSFS && MTD_UBI || UBIFS_FS_DEBUG && MISC_FILESYSTEMS &&
UBIFS_FS || LOCKDEP && DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT &&
STACKTRACE_SUPPORT && LOCKDEP_SUPPORT || LATENCYTOP && HAVE_LATENCYTOP_SUPPORT &&
DEBUG_KERNEL && STACKTRACE_SUPPORT && PROC_FS) selects KALLSYMS_ALL
which has unmet direct dependencies (DEBUG_KERNEL && KALLSYMS)
Signed-off-by: Randy Dunlap
Signed-off-by: Artem Bityutskiy
---
drivers/mtd/ubi/Kconfig.debug | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
(limited to 'drivers')
diff --git a/drivers/mtd/ubi/Kconfig.debug b/drivers/mtd/ubi/Kconfig.debug
index 2246f154e2f7..61f6e5e40458 100644
--- a/drivers/mtd/ubi/Kconfig.debug
+++ b/drivers/mtd/ubi/Kconfig.debug
@@ -6,7 +6,7 @@ config MTD_UBI_DEBUG
depends on SYSFS
depends on MTD_UBI
select DEBUG_FS
- select KALLSYMS_ALL
+ select KALLSYMS_ALL if KALLSYMS && DEBUG_KERNEL
help
This option enables UBI debugging.
--
cgit v1.2.3
From d3f6e6c666c0f68991d785177c4c62fcd1d651f2 Mon Sep 17 00:00:00 2001
From: Artem Bityutskiy
Date: Sun, 29 Aug 2010 23:34:44 +0300
Subject: UBI: do not oops when erroneous PEB is scheduled for scrubbing
When an erroneous PEB is scheduling for scrubbing, we end up with the
following oops:
[] (prot_queue_del+0x0/0x50) from [] (ubi_wl_scrub_peb+0xec/0x13c)
[] (ubi_wl_scrub_peb+0x0/0x13c) from [] (ubi_eba_read_leb+0x200/0x428)
[] (ubi_eba_read_leb+0x0/0x428) from [] (ubi_leb_read+0xe8/0x138)
[] (ubi_leb_read+0x0/0x138) from [] (ubifs_start_scan+0x7c/0xf4)
[] (ubifs_start_scan+0x0/0xf4) from [] (ubifs_recover_leb+0x3c/0x730)
[] (ubifs_recover_leb+0x0/0x730) from [] (ubifs_recover_log_leb+0xc8/0x2dc)
[] (ubifs_recover_log_leb+0x0/0x2dc) from [] (ubifs_replay_journal+0xb90/0x13a4)
[] (ubifs_replay_journal+0x0/0x13a4) from [] (ubifs_fill_super+0xb84/0x1054)
[] (ubifs_fill_super+0x0/0x1054) from [] (ubifs_get_sb+0xc4/0x2ac)
[] (ubifs_get_sb+0x0/0x2ac) from [] (vfs_kern_mount+0x58/0x94)
[] (vfs_kern_mount+0x0/0x94) from [] (do_kern_mount+0x40/0xe8)
[] (do_kern_mount+0x0/0xe8) from [] (do_new_mount+0x68/0x8c)
[] (do_new_mount+0x0/0x8c) from [] (do_mount+0x15c/0x1b8)
[] (do_mount+0x0/0x1b8) from [] (sys_mount+0x8c/0xd4)
[] (sys_mount+0x0/0xd4) from [] (ret_fast_syscall+0x0/0x2c)
Kernel panic - not syncing: Fatal exception
The problem is that 'ubi_wl_scrub_peb()' does not expect that PEBs may
be in the erroneous tree, which is a bug. This patch fixes the bug
and adds corresponding check to 'ubi_wl_scrub_peb()'. Now it will simply
ignore erroneous PEBs, instead of causing an oops.
Reported-by: Matthieu CASTET
Signed-off-by: Artem Bityutskiy
---
drivers/mtd/ubi/wl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
(limited to 'drivers')
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index ee7b1d8fbb92..97a435672eaf 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -1212,7 +1212,8 @@ int ubi_wl_scrub_peb(struct ubi_device *ubi, int pnum)
retry:
spin_lock(&ubi->wl_lock);
e = ubi->lookuptbl[pnum];
- if (e == ubi->move_from || in_wl_tree(e, &ubi->scrub)) {
+ if (e == ubi->move_from || in_wl_tree(e, &ubi->scrub) ||
+ in_wl_tree(e, &ubi->erroneous)) {
spin_unlock(&ubi->wl_lock);
return 0;
}
--
cgit v1.2.3