UBI: do propagate positive error codes up
authorArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
Tue, 25 Nov 2014 09:34:02 +0000 (11:34 +0200)
committerRichard Weinberger <richard@nod.at>
Wed, 28 Jan 2015 15:09:25 +0000 (16:09 +0100)
UBI uses positive function return codes internally, and should not propagate
them up, except in the place this path fixes. Here is the original bug report
from Dan Carpenter:

The problem is really in ubi_eba_read_leb().

drivers/mtd/ubi/eba.c
   412                  err = ubi_io_read_vid_hdr(ubi, pnum, vid_hdr, 1);
   413                  if (err && err != UBI_IO_BITFLIPS) {
   414                          if (err > 0) {
   415                                  /*
   416                                   * The header is either absent or corrupted.
   417                                   * The former case means there is a bug -
   418                                   * switch to read-only mode just in case.
   419                                   * The latter case means a real corruption - we
   420                                   * may try to recover data. FIXME: but this is
   421                                   * not implemented.
   422                                   */
   423                                  if (err == UBI_IO_BAD_HDR_EBADMSG ||
   424                                      err == UBI_IO_BAD_HDR) {
   425                                          ubi_warn("corrupted VID header at PEB %d, LEB %d:%d",
   426                                                   pnum, vol_id, lnum);
   427                                          err = -EBADMSG;
   428                                  } else
   429                                          ubi_ro_mode(ubi);

On this path we return UBI_IO_FF and UBI_IO_FF_BITFLIPS and it
eventually gets passed to ERR_PTR().  We probably dereference the bad
pointer and oops.  At that point we've gone read only so it was already
a bad situation...

   430                          }
   431                          goto out_free;
   432                  } else if (err == UBI_IO_BITFLIPS)
   433                          scrub = 1;
   434

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
drivers/mtd/ubi/eba.c

index f1db73da79756c378b88ff9d52b5c2f924a7aa50..da4c79259f67f3e2bd63a62570845eb10c89e989 100644 (file)
@@ -426,6 +426,7 @@ retry:
                                                 pnum, vol_id, lnum);
                                        err = -EBADMSG;
                                } else
+                                       err = -EINVAL;
                                        ubi_ro_mode(ubi);
                        }
                        goto out_free;