Merge tag 'upstream-3.14-rc5' of git://git.infradead.org/linux-ubifs

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

Pull ubifs fix from Artem Bityutskiy:
"Just a single fix for the UBI module unload path which makes sure we
do not touch freed memory"

* tag 'upstream-3.14-rc5' of git://git.infradead.org/linux-ubifs:
UBI: fix some use after free bugs

Linus Torvalds 12 years ago bb7d43b1 d2a04763

+4 -4

1 changed file

expand all

drivers

mtd

ubi

fastmap.c

+4 -4

drivers/mtd/ubi/fastmap.c

··· 463 463 } 464 464 } 465 465 if (found_orphan) { 466 - kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 467 466 list_del(&tmp_aeb->u.list); 467 + kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 468 468 } 469 469 470 470 new_aeb = kmem_cache_alloc(ai->aeb_slab_cache, ··· 846 846 ret = UBI_BAD_FASTMAP; 847 847 fail: 848 848 list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &used, u.list) { 849 - kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 850 849 list_del(&tmp_aeb->u.list); 850 + kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 851 851 } 852 852 list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &eba_orphans, u.list) { 853 - kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 854 853 list_del(&tmp_aeb->u.list); 854 + kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 855 855 } 856 856 list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &free, u.list) { 857 - kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 858 857 list_del(&tmp_aeb->u.list); 858 + kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 859 859 } 860 860 861 861 return ret;