summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2014-05-05 07:48:50 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2014-05-05 07:48:50 -0700
commitcae1d2cab43bb34c242f272da499bf5f25d778c7 (patch)
tree81ed56a81f101c893f5ea2121016520348cfa5f3 /drivers
parent2145e15e0557a01b9195d1c7199a1b92cb9be81f (diff)
parentbebfef150e0b8fa68704cddacf05b8c26462d565 (diff)
Merge tag 'upstream-3.15-rc5' of git://git.infradead.org/linux-ubifs
Pull ubifs fixes from Artem Bityutskiy: "This includes the following fixes: - two real bug-fixes from Tanya for the still "experimental" UBI fastmap feature - a one-liner from Kees which hardens kernel security - a small error-path fix, where we forget to free various resources in case of failure - spotted by the 'smatch' tool" * tag 'upstream-3.15-rc5' of git://git.infradead.org/linux-ubifs: UBI: avoid workqueue format string leak UBI: fix ubi free PEBs count calculation UBI: fix error path in __wl_get_peb UBIFS: fix remount error path
Diffstat (limited to 'drivers')
-rw-r--r--drivers/mtd/ubi/block.c2
-rw-r--r--drivers/mtd/ubi/wl.c6
2 files changed, 7 insertions, 1 deletions
diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c
index 7ff473c871a9..8d659e6a1b4c 100644
--- a/drivers/mtd/ubi/block.c
+++ b/drivers/mtd/ubi/block.c
@@ -431,7 +431,7 @@ int ubiblock_create(struct ubi_volume_info *vi)
* Create one workqueue per volume (per registered block device).
* Rembember workqueues are cheap, they're not threads.
*/
- dev->wq = alloc_workqueue(gd->disk_name, 0, 0);
+ dev->wq = alloc_workqueue("%s", 0, 0, gd->disk_name);
if (!dev->wq)
goto out_free_queue;
INIT_WORK(&dev->work, ubiblock_do_work);
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 02317c1c0238..0f3425dac910 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -671,6 +671,8 @@ static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi)
e = find_wl_entry(ubi, &ubi->free, WL_FREE_MAX_DIFF);
self_check_in_wl_tree(ubi, e, &ubi->free);
+ ubi->free_count--;
+ ubi_assert(ubi->free_count >= 0);
rb_erase(&e->u.rb, &ubi->free);
return e;
@@ -684,6 +686,9 @@ int ubi_wl_get_peb(struct ubi_device *ubi)
peb = __wl_get_peb(ubi);
spin_unlock(&ubi->wl_lock);
+ if (peb < 0)
+ return peb;
+
err = ubi_self_check_all_ff(ubi, peb, ubi->vid_hdr_aloffset,
ubi->peb_size - ubi->vid_hdr_aloffset);
if (err) {
@@ -1068,6 +1073,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
/* Give the unused PEB back */
wl_tree_add(e2, &ubi->free);
+ ubi->free_count++;
goto out_cancel;
}
self_check_in_wl_tree(ubi, e1, &ubi->used);