ubi: Error freeing ubi->vtbl while unloading

ubi: Error freeing ubi->vtbl while unloading

[Vinit Agnihotri]

I downloaded latest git & backported ubi to make it work in linux
kernel 2.6.18.3.

Machine details
 AMD opteron 64bit SMP, linux kernel version 2.6.18.3

However while unloading ubi I discovered slab corruption. Ths problem
is as follows.

ubi->vtbl is allocated using vmalloc() in vtbl.c empty_create_lvol(),
but it is freed in build.c with kfree()

Heres a patch that makes a fix

--- build.c	2007-06-07 14:54:49.000000000 +0530
+++ build.c	2007-06-15 15:22:32.000000000 +0530
@@ -369,7 +369,7 @@
 out_wl:
 	ubi_wl_close(ubi);
 out_vtbl:
-	kfree(ubi->vtbl);
+	vfree(ubi->vtbl);
 out_si:
 	ubi_scan_destroy_si(si);
 	return err;
@@ -629,7 +629,7 @@
 out_detach:
 	ubi_eba_close(ubi);
 	ubi_wl_close(ubi);
-	kfree(ubi->vtbl);
+	vfree(ubi->vtbl);
 out_free:
 	kfree(ubi);
 out_mtd:


-- I feel free now

Re: ubi: Error freeing ubi->vtbl while unloading

[Artem Bityutskiy]

On Fri, 2007-06-15 at 15:31 +0530, Vinit Agnihotri wrote:
> I downloaded latest git & backported ubi to make it work in linux
> kernel 2.6.18.3.
> 
> Machine details
>  AMD opteron 64bit SMP, linux kernel version 2.6.18.3
> 
> However while unloading ubi I discovered slab corruption. Ths problem
> is as follows.
> 
> ubi->vtbl is allocated using vmalloc() in vtbl.c empty_create_lvol(),
> but it is freed in build.c with kfree()

Thanks, fixed the patch, added Signed-off-by and committed. 

-- 
Best regards,
Artem Bityutskiy (Битюцкий Артём)

Re: ubi: Error freeing ubi->vtbl while unloading

[Josh Boyer]

On 6/17/07, Artem Bityutskiy <dedekind@infradead.org> wrote:
> On Fri, 2007-06-15 at 15:31 +0530, Vinit Agnihotri wrote:
> > I downloaded latest git & backported ubi to make it work in linux
> > kernel 2.6.18.3.
> >
> > Machine details
> >  AMD opteron 64bit SMP, linux kernel version 2.6.18.3
> >
> > However while unloading ubi I discovered slab corruption. Ths problem
> > is as follows.
> >
> > ubi->vtbl is allocated using vmalloc() in vtbl.c empty_create_lvol(),
> > but it is freed in build.c with kfree()
>
> Thanks, fixed the patch, added Signed-off-by and committed.

You added Vinit's sign off, which was missing in the first place.  Not
that I really care, but you shouldn't do that for other people.  Since
you had to fix the patch anyway, you could have done a "Reported-By:"
or something similar and it wouldn't have raised my paranoia flags at
all.

josh

Re: ubi: Error freeing ubi->vtbl while unloading

[Artem Bityutskiy]

Josh,

On Sun, 2007-06-17 at 19:59 -0500, Josh Boyer wrote:
> You added Vinit's sign off, which was missing in the first place.  Not
> that I really care, but you shouldn't do that for other people.  Since
> you had to fix the patch anyway, you could have done a "Reported-By:"
> or something similar and it wouldn't have raised my paranoia flags at
> all.

fair point, I'll take this into account next time, thanks.

-- 
Best regards,
Artem Bityutskiy (Битюцкий Артём)