ubi: fastmap: Free unused fastmap anchor peb during detach (c16f39d1) · Commits · 戴 / test

When CONFIG_MTD_UBI_FASTMAP is enabled, fm_anchor will be assigned a free PEB during ubi_wl_init() or ubi_update_fastmap(). However if fastmap is not used or disabled on the MTD device, ubi_wl_entry related with the PEB will not be freed during detach. So Fix it by freeing the unused fastmap anchor during detach. Fixes: ("ubi: Fix producing anchor PEBs") Reported-by:

<syzbot+f317896aae32eb281a58@syzkaller.appspotmail.com> Reviewed-by:

Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by:

Hou Tao <houtao1@huawei.com> Signed-off-by:

Richard Weinberger <richard@nod.at>

drivers/mtd/ubi/fastmap-wl.c

+13 −2

Original line number	Diff line number	Diff line
		@@ -39,6 +39,13 @@ static struct ubi_wl_entry find_anchor_wl_entry(struct rb_root root)
		return victim;
		}

		static inline void return_unused_peb(struct ubi_device *ubi,
		struct ubi_wl_entry *e)
		{
		wl_tree_add(e, &ubi->free);
		ubi->free_count++;
		}

		/**
		* return_unused_pool_pebs - returns unused PEB to the free tree.
		* @ubi: UBI device description object
		@@ -52,8 +59,7 @@ static void return_unused_pool_pebs(struct ubi_device *ubi,

		for (i = pool->used; i < pool->size; i++) {
		e = ubi->lookuptbl[pool->pebs[i]];
		wl_tree_add(e, &ubi->free);
		ubi->free_count++;
		return_unused_peb(ubi, e);
		}
		}

		@@ -361,6 +367,11 @@ static void ubi_fastmap_close(struct ubi_device *ubi)
		return_unused_pool_pebs(ubi, &ubi->fm_pool);
		return_unused_pool_pebs(ubi, &ubi->fm_wl_pool);

		if (ubi->fm_anchor) {
		return_unused_peb(ubi, ubi->fm_anchor);
		ubi->fm_anchor = NULL;
		}

		if (ubi->fm) {
		for (i = 0; i < ubi->fm->used_blocks; i++)
		kfree(ubi->fm->e[i]);

Admin message