<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/mtd/ubi, branch v3.10.78</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>UBI: fix soft lockup in ubi_check_volume()</title>
<updated>2015-05-13T12:15:43+00:00</updated>
<author>
<name>hujianyang</name>
<email>hujianyang@huawei.com</email>
</author>
<published>2014-12-30T03:56:09+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ad233850c2fa3057c0ba86e674ed9c26cc96ddd5'/>
<id>ad233850c2fa3057c0ba86e674ed9c26cc96ddd5</id>
<content type='text'>
commit 9aa272b492e7551a9ee0e2c83c720ea013698485 upstream.

Running mtd-utils/tests/ubi-tests/io_basic.c could cause
soft lockup or watchdog reset. It is because *updatevol*
will perform ubi_check_volume() after updating finish
and this function will full scan the updated lebs if the
volume is initialized as STATIC_VOLUME.

This patch adds *cond_resched()* in the loop of lebs scan
to avoid soft lockup.

Helped by Richard Weinberger &lt;richard@nod.at&gt;

[ 2158.067096] INFO: rcu_sched self-detected stall on CPU { 1}  (t=2101 jiffies g=1606 c=1605 q=56)
[ 2158.172867] CPU: 1 PID: 2073 Comm: io_basic Tainted: G           O 3.10.53 #21
[ 2158.172898] [&lt;c000f624&gt;] (unwind_backtrace+0x0/0x120) from [&lt;c000c294&gt;] (show_stack+0x10/0x14)
[ 2158.172918] [&lt;c000c294&gt;] (show_stack+0x10/0x14) from [&lt;c008ac3c&gt;] (rcu_check_callbacks+0x1c0/0x660)
[ 2158.172936] [&lt;c008ac3c&gt;] (rcu_check_callbacks+0x1c0/0x660) from [&lt;c002b480&gt;] (update_process_times+0x38/0x64)
[ 2158.172953] [&lt;c002b480&gt;] (update_process_times+0x38/0x64) from [&lt;c005ff38&gt;] (tick_sched_handle+0x54/0x60)
[ 2158.172966] [&lt;c005ff38&gt;] (tick_sched_handle+0x54/0x60) from [&lt;c00601ac&gt;] (tick_sched_timer+0x44/0x74)
[ 2158.172978] [&lt;c00601ac&gt;] (tick_sched_timer+0x44/0x74) from [&lt;c003f348&gt;] (__run_hrtimer+0xc8/0x1b8)
[ 2158.172992] [&lt;c003f348&gt;] (__run_hrtimer+0xc8/0x1b8) from [&lt;c003fd9c&gt;] (hrtimer_interrupt+0x128/0x2a4)
[ 2158.173007] [&lt;c003fd9c&gt;] (hrtimer_interrupt+0x128/0x2a4) from [&lt;c0246f1c&gt;] (arch_timer_handler_virt+0x28/0x30)
[ 2158.173022] [&lt;c0246f1c&gt;] (arch_timer_handler_virt+0x28/0x30) from [&lt;c0086214&gt;] (handle_percpu_devid_irq+0x9c/0x124)
[ 2158.173036] [&lt;c0086214&gt;] (handle_percpu_devid_irq+0x9c/0x124) from [&lt;c0082bd8&gt;] (generic_handle_irq+0x20/0x30)
[ 2158.173049] [&lt;c0082bd8&gt;] (generic_handle_irq+0x20/0x30) from [&lt;c000969c&gt;] (handle_IRQ+0x64/0x8c)
[ 2158.173060] [&lt;c000969c&gt;] (handle_IRQ+0x64/0x8c) from [&lt;c0008544&gt;] (gic_handle_irq+0x3c/0x60)
[ 2158.173074] [&lt;c0008544&gt;] (gic_handle_irq+0x3c/0x60) from [&lt;c02f0f80&gt;] (__irq_svc+0x40/0x50)
[ 2158.173083] Exception stack(0xc4043c98 to 0xc4043ce0)
[ 2158.173092] 3c80:                                                       c4043ce4 00000019
[ 2158.173102] 3ca0: 1f8a865f c050ad10 1f8a864c 00000031 c04b5970 0003ebce 00000000 f3550000
[ 2158.173113] 3cc0: bf00bc68 00000800 0003ebce c4043ce0 c0186d14 c0186cb8 80000013 ffffffff
[ 2158.173130] [&lt;c02f0f80&gt;] (__irq_svc+0x40/0x50) from [&lt;c0186cb8&gt;] (read_current_timer+0x4/0x38)
[ 2158.173145] [&lt;c0186cb8&gt;] (read_current_timer+0x4/0x38) from [&lt;1f8a865f&gt;] (0x1f8a865f)
[ 2183.927097] BUG: soft lockup - CPU#1 stuck for 22s! [io_basic:2073]
[ 2184.002229] Modules linked in: nandflash(O) [last unloaded: nandflash]

Signed-off-by: Wang Kai &lt;morgan.wang@huawei.com&gt;
Signed-off-by: hujianyang &lt;hujianyang@huawei.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 9aa272b492e7551a9ee0e2c83c720ea013698485 upstream.

Running mtd-utils/tests/ubi-tests/io_basic.c could cause
soft lockup or watchdog reset. It is because *updatevol*
will perform ubi_check_volume() after updating finish
and this function will full scan the updated lebs if the
volume is initialized as STATIC_VOLUME.

This patch adds *cond_resched()* in the loop of lebs scan
to avoid soft lockup.

Helped by Richard Weinberger &lt;richard@nod.at&gt;

[ 2158.067096] INFO: rcu_sched self-detected stall on CPU { 1}  (t=2101 jiffies g=1606 c=1605 q=56)
[ 2158.172867] CPU: 1 PID: 2073 Comm: io_basic Tainted: G           O 3.10.53 #21
[ 2158.172898] [&lt;c000f624&gt;] (unwind_backtrace+0x0/0x120) from [&lt;c000c294&gt;] (show_stack+0x10/0x14)
[ 2158.172918] [&lt;c000c294&gt;] (show_stack+0x10/0x14) from [&lt;c008ac3c&gt;] (rcu_check_callbacks+0x1c0/0x660)
[ 2158.172936] [&lt;c008ac3c&gt;] (rcu_check_callbacks+0x1c0/0x660) from [&lt;c002b480&gt;] (update_process_times+0x38/0x64)
[ 2158.172953] [&lt;c002b480&gt;] (update_process_times+0x38/0x64) from [&lt;c005ff38&gt;] (tick_sched_handle+0x54/0x60)
[ 2158.172966] [&lt;c005ff38&gt;] (tick_sched_handle+0x54/0x60) from [&lt;c00601ac&gt;] (tick_sched_timer+0x44/0x74)
[ 2158.172978] [&lt;c00601ac&gt;] (tick_sched_timer+0x44/0x74) from [&lt;c003f348&gt;] (__run_hrtimer+0xc8/0x1b8)
[ 2158.172992] [&lt;c003f348&gt;] (__run_hrtimer+0xc8/0x1b8) from [&lt;c003fd9c&gt;] (hrtimer_interrupt+0x128/0x2a4)
[ 2158.173007] [&lt;c003fd9c&gt;] (hrtimer_interrupt+0x128/0x2a4) from [&lt;c0246f1c&gt;] (arch_timer_handler_virt+0x28/0x30)
[ 2158.173022] [&lt;c0246f1c&gt;] (arch_timer_handler_virt+0x28/0x30) from [&lt;c0086214&gt;] (handle_percpu_devid_irq+0x9c/0x124)
[ 2158.173036] [&lt;c0086214&gt;] (handle_percpu_devid_irq+0x9c/0x124) from [&lt;c0082bd8&gt;] (generic_handle_irq+0x20/0x30)
[ 2158.173049] [&lt;c0082bd8&gt;] (generic_handle_irq+0x20/0x30) from [&lt;c000969c&gt;] (handle_IRQ+0x64/0x8c)
[ 2158.173060] [&lt;c000969c&gt;] (handle_IRQ+0x64/0x8c) from [&lt;c0008544&gt;] (gic_handle_irq+0x3c/0x60)
[ 2158.173074] [&lt;c0008544&gt;] (gic_handle_irq+0x3c/0x60) from [&lt;c02f0f80&gt;] (__irq_svc+0x40/0x50)
[ 2158.173083] Exception stack(0xc4043c98 to 0xc4043ce0)
[ 2158.173092] 3c80:                                                       c4043ce4 00000019
[ 2158.173102] 3ca0: 1f8a865f c050ad10 1f8a864c 00000031 c04b5970 0003ebce 00000000 f3550000
[ 2158.173113] 3cc0: bf00bc68 00000800 0003ebce c4043ce0 c0186d14 c0186cb8 80000013 ffffffff
[ 2158.173130] [&lt;c02f0f80&gt;] (__irq_svc+0x40/0x50) from [&lt;c0186cb8&gt;] (read_current_timer+0x4/0x38)
[ 2158.173145] [&lt;c0186cb8&gt;] (read_current_timer+0x4/0x38) from [&lt;1f8a865f&gt;] (0x1f8a865f)
[ 2183.927097] BUG: soft lockup - CPU#1 stuck for 22s! [io_basic:2073]
[ 2184.002229] Modules linked in: nandflash(O) [last unloaded: nandflash]

Signed-off-by: Wang Kai &lt;morgan.wang@huawei.com&gt;
Signed-off-by: hujianyang &lt;hujianyang@huawei.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>UBI: fix check for "too many bytes"</title>
<updated>2015-05-06T19:56:26+00:00</updated>
<author>
<name>Brian Norris</name>
<email>computersforpeace@gmail.com</email>
</author>
<published>2015-02-28T10:23:28+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a4014203612e80fb6de1e0f3f70de84ad8ba75fa'/>
<id>a4014203612e80fb6de1e0f3f70de84ad8ba75fa</id>
<content type='text'>
commit 299d0c5b27346a77a0777c993372bf8777d4f2e5 upstream.

The comparison from the previous line seems to have been erroneously
(partially) copied-and-pasted onto the next. The second line should be
checking req.bytes, not req.lnum.

Coverity CID #139400

Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
[rw: Fixed comparison]
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 299d0c5b27346a77a0777c993372bf8777d4f2e5 upstream.

The comparison from the previous line seems to have been erroneously
(partially) copied-and-pasted onto the next. The second line should be
checking req.bytes, not req.lnum.

Coverity CID #139400

Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
[rw: Fixed comparison]
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>UBI: initialize LEB number variable</title>
<updated>2015-05-06T19:56:26+00:00</updated>
<author>
<name>Brian Norris</name>
<email>computersforpeace@gmail.com</email>
</author>
<published>2015-02-28T10:23:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7e0a5b1f3d114523b282e71462dcf0cc6006a884'/>
<id>7e0a5b1f3d114523b282e71462dcf0cc6006a884</id>
<content type='text'>
commit f16db8071ce18819fbd705ddcc91c6f392fb61f8 upstream.

In some of the 'out_not_moved' error paths, lnum may be used
uninitialized. Don't ignore the warning; let's fix it.

This uninitialized variable doesn't have much visible effect in the end,
since we just schedule the PEB for erasure, and its LEB number doesn't
really matter (it just gets printed in debug messages). But let's get it
straight anyway.

Coverity CID #113449

Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit f16db8071ce18819fbd705ddcc91c6f392fb61f8 upstream.

In some of the 'out_not_moved' error paths, lnum may be used
uninitialized. Don't ignore the warning; let's fix it.

This uninitialized variable doesn't have much visible effect in the end,
since we just schedule the PEB for erasure, and its LEB number doesn't
really matter (it just gets printed in debug messages). But let's get it
straight anyway.

Coverity CID #113449

Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>UBI: fix out of bounds write</title>
<updated>2015-05-06T19:56:26+00:00</updated>
<author>
<name>Brian Norris</name>
<email>computersforpeace@gmail.com</email>
</author>
<published>2015-02-28T10:23:26+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=5fd7a188f8471516981df3f6b061f7d2ea470616'/>
<id>5fd7a188f8471516981df3f6b061f7d2ea470616</id>
<content type='text'>
commit d74adbdb9abf0d2506a6c4afa534d894f28b763f upstream.

If aeb-&gt;len &gt;= vol-&gt;reserved_pebs, we should not be writing aeb into the
PEB-&gt;LEB mapping.

Caught by Coverity, CID #711212.

Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit d74adbdb9abf0d2506a6c4afa534d894f28b763f upstream.

If aeb-&gt;len &gt;= vol-&gt;reserved_pebs, we should not be writing aeb into the
PEB-&gt;LEB mapping.

Caught by Coverity, CID #711212.

Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>UBI: account for bitflips in both the VID header and data</title>
<updated>2015-05-06T19:56:26+00:00</updated>
<author>
<name>Brian Norris</name>
<email>computersforpeace@gmail.com</email>
</author>
<published>2015-02-28T10:23:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ac38b131c6f9ccf52bf0687158540673da1d1f5b'/>
<id>ac38b131c6f9ccf52bf0687158540673da1d1f5b</id>
<content type='text'>
commit 8eef7d70f7c6772c3490f410ee2bceab3b543fa1 upstream.

We are completely discarding the earlier value of 'bitflips', which
could reflect a bitflip found in ubi_io_read_vid_hdr(). Let's use the
bitwise OR of header and data 'bitflip' statuses instead.

Coverity CID #1226856

Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 8eef7d70f7c6772c3490f410ee2bceab3b543fa1 upstream.

We are completely discarding the earlier value of 'bitflips', which
could reflect a bitflip found in ubi_io_read_vid_hdr(). Let's use the
bitwise OR of header and data 'bitflip' statuses instead.

Coverity CID #1226856

Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>UBI: Fix double free after do_sync_erase()</title>
<updated>2015-01-16T14:59:01+00:00</updated>
<author>
<name>Richard Weinberger</name>
<email>richard@nod.at</email>
</author>
<published>2014-11-06T15:47:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ccebbb7e53c8d028961340d3081d69658f8a5bef'/>
<id>ccebbb7e53c8d028961340d3081d69658f8a5bef</id>
<content type='text'>
commit aa5ad3b6eb8feb2399a5d26c8fb0060561bb9534 upstream.

If the erase worker is unable to erase a PEB it will
free the ubi_wl_entry itself.
The failing ubi_wl_entry must not free()'d again after
do_sync_erase() returns.

Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Artem Bityutskiy &lt;artem.bityutskiy@linux.intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit aa5ad3b6eb8feb2399a5d26c8fb0060561bb9534 upstream.

If the erase worker is unable to erase a PEB it will
free the ubi_wl_entry itself.
The failing ubi_wl_entry must not free()'d again after
do_sync_erase() returns.

Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Artem Bityutskiy &lt;artem.bityutskiy@linux.intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>UBI: Fix invalid vfree()</title>
<updated>2015-01-16T14:59:01+00:00</updated>
<author>
<name>Richard Weinberger</name>
<email>richard@nod.at</email>
</author>
<published>2014-10-26T23:46:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=398dd8fd97a3cf7777c5ee0fb1b52b8ec2edf9b8'/>
<id>398dd8fd97a3cf7777c5ee0fb1b52b8ec2edf9b8</id>
<content type='text'>
commit f38aed975c0c3645bbdfc5ebe35726e64caaf588 upstream.

The logic of vfree()'ing vol-&gt;upd_buf is tied to vol-&gt;updating.
In ubi_start_update() vol-&gt;updating is set long before vmalloc()'ing
vol-&gt;upd_buf. If we encounter a write failure in ubi_start_update()
before vmalloc() the UBI device release function will try to vfree()
vol-&gt;upd_buf because vol-&gt;updating is set.
Fix this by allocating vol-&gt;upd_buf directly after setting vol-&gt;updating.

Fixes:
[   31.559338] UBI warning: vol_cdev_release: update of volume 2 not finished, volume is damaged
[   31.559340] ------------[ cut here ]------------
[   31.559343] WARNING: CPU: 1 PID: 2747 at mm/vmalloc.c:1446 __vunmap+0xe3/0x110()
[   31.559344] Trying to vfree() nonexistent vm area (ffffc90001f2b000)
[   31.559345] Modules linked in:
[   31.565620]  0000000000000bba ffff88002a0cbdb0 ffffffff818f0497 ffff88003b9ba148
[   31.566347]  ffff88002a0cbde0 ffffffff8156f515 ffff88003b9ba148 0000000000000bba
[   31.567073]  0000000000000000 0000000000000000 ffff88002a0cbe88 ffffffff8156c10a
[   31.567793] Call Trace:
[   31.568034]  [&lt;ffffffff818f0497&gt;] dump_stack+0x4e/0x7a
[   31.568510]  [&lt;ffffffff8156f515&gt;] ubi_io_write_vid_hdr+0x155/0x160
[   31.569084]  [&lt;ffffffff8156c10a&gt;] ubi_eba_write_leb+0x23a/0x870
[   31.569628]  [&lt;ffffffff81569b36&gt;] vol_cdev_write+0x226/0x380
[   31.570155]  [&lt;ffffffff81179265&gt;] vfs_write+0xb5/0x1f0
[   31.570627]  [&lt;ffffffff81179f8a&gt;] SyS_pwrite64+0x6a/0xa0
[   31.571123]  [&lt;ffffffff818fde12&gt;] system_call_fastpath+0x16/0x1b

Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Artem Bityutskiy &lt;artem.bityutskiy@linux.intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit f38aed975c0c3645bbdfc5ebe35726e64caaf588 upstream.

The logic of vfree()'ing vol-&gt;upd_buf is tied to vol-&gt;updating.
In ubi_start_update() vol-&gt;updating is set long before vmalloc()'ing
vol-&gt;upd_buf. If we encounter a write failure in ubi_start_update()
before vmalloc() the UBI device release function will try to vfree()
vol-&gt;upd_buf because vol-&gt;updating is set.
Fix this by allocating vol-&gt;upd_buf directly after setting vol-&gt;updating.

Fixes:
[   31.559338] UBI warning: vol_cdev_release: update of volume 2 not finished, volume is damaged
[   31.559340] ------------[ cut here ]------------
[   31.559343] WARNING: CPU: 1 PID: 2747 at mm/vmalloc.c:1446 __vunmap+0xe3/0x110()
[   31.559344] Trying to vfree() nonexistent vm area (ffffc90001f2b000)
[   31.559345] Modules linked in:
[   31.565620]  0000000000000bba ffff88002a0cbdb0 ffffffff818f0497 ffff88003b9ba148
[   31.566347]  ffff88002a0cbde0 ffffffff8156f515 ffff88003b9ba148 0000000000000bba
[   31.567073]  0000000000000000 0000000000000000 ffff88002a0cbe88 ffffffff8156c10a
[   31.567793] Call Trace:
[   31.568034]  [&lt;ffffffff818f0497&gt;] dump_stack+0x4e/0x7a
[   31.568510]  [&lt;ffffffff8156f515&gt;] ubi_io_write_vid_hdr+0x155/0x160
[   31.569084]  [&lt;ffffffff8156c10a&gt;] ubi_eba_write_leb+0x23a/0x870
[   31.569628]  [&lt;ffffffff81569b36&gt;] vol_cdev_write+0x226/0x380
[   31.570155]  [&lt;ffffffff81179265&gt;] vfs_write+0xb5/0x1f0
[   31.570627]  [&lt;ffffffff81179f8a&gt;] SyS_pwrite64+0x6a/0xa0
[   31.571123]  [&lt;ffffffff818fde12&gt;] system_call_fastpath+0x16/0x1b

Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Artem Bityutskiy &lt;artem.bityutskiy@linux.intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>UBI: add missing kmem_cache_free() in process_pool_aeb error path</title>
<updated>2014-11-14T16:47:55+00:00</updated>
<author>
<name>Richard Genoud</name>
<email>richard.genoud@gmail.com</email>
</author>
<published>2014-09-09T12:25:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7a6f66a916d51ac1210c9658b223cd154d92e676'/>
<id>7a6f66a916d51ac1210c9658b223cd154d92e676</id>
<content type='text'>
commit 1bf1890e86869032099b539bc83b098be12fc5a7 upstream.

I ran into this error after a ubiupdatevol, because I forgot to backport
e9110361a9a4 UBI: fix the volumes tree sorting criteria.

UBI error: process_pool_aeb: orphaned volume in fastmap pool
UBI error: ubi_scan_fastmap: Attach by fastmap failed, doing a full scan!
kmem_cache_destroy ubi_ainf_peb_slab: Slab cache still has objects
CPU: 0 PID: 1 Comm: swapper Not tainted 3.14.18-00053-gf05cac8dbf85 #1
[&lt;c000d298&gt;] (unwind_backtrace) from [&lt;c000baa8&gt;] (show_stack+0x10/0x14)
[&lt;c000baa8&gt;] (show_stack) from [&lt;c01b7a68&gt;] (destroy_ai+0x230/0x244)
[&lt;c01b7a68&gt;] (destroy_ai) from [&lt;c01b8fd4&gt;] (ubi_attach+0x98/0x1ec)
[&lt;c01b8fd4&gt;] (ubi_attach) from [&lt;c01ade90&gt;] (ubi_attach_mtd_dev+0x2b8/0x868)
[&lt;c01ade90&gt;] (ubi_attach_mtd_dev) from [&lt;c038b510&gt;] (ubi_init+0x1dc/0x2ac)
[&lt;c038b510&gt;] (ubi_init) from [&lt;c0008860&gt;] (do_one_initcall+0x94/0x140)
[&lt;c0008860&gt;] (do_one_initcall) from [&lt;c037aadc&gt;] (kernel_init_freeable+0xe8/0x1b0)
[&lt;c037aadc&gt;] (kernel_init_freeable) from [&lt;c02730ac&gt;] (kernel_init+0x8/0xe4)
[&lt;c02730ac&gt;] (kernel_init) from [&lt;c00093f0&gt;] (ret_from_fork+0x14/0x24)
UBI: scanning is finished

Freeing the cache in the error path fixes the Slab error.

Tested on at91sam9g35 (3.14.18+fastmap backports)

Signed-off-by: Richard Genoud &lt;richard.genoud@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 1bf1890e86869032099b539bc83b098be12fc5a7 upstream.

I ran into this error after a ubiupdatevol, because I forgot to backport
e9110361a9a4 UBI: fix the volumes tree sorting criteria.

UBI error: process_pool_aeb: orphaned volume in fastmap pool
UBI error: ubi_scan_fastmap: Attach by fastmap failed, doing a full scan!
kmem_cache_destroy ubi_ainf_peb_slab: Slab cache still has objects
CPU: 0 PID: 1 Comm: swapper Not tainted 3.14.18-00053-gf05cac8dbf85 #1
[&lt;c000d298&gt;] (unwind_backtrace) from [&lt;c000baa8&gt;] (show_stack+0x10/0x14)
[&lt;c000baa8&gt;] (show_stack) from [&lt;c01b7a68&gt;] (destroy_ai+0x230/0x244)
[&lt;c01b7a68&gt;] (destroy_ai) from [&lt;c01b8fd4&gt;] (ubi_attach+0x98/0x1ec)
[&lt;c01b8fd4&gt;] (ubi_attach) from [&lt;c01ade90&gt;] (ubi_attach_mtd_dev+0x2b8/0x868)
[&lt;c01ade90&gt;] (ubi_attach_mtd_dev) from [&lt;c038b510&gt;] (ubi_init+0x1dc/0x2ac)
[&lt;c038b510&gt;] (ubi_init) from [&lt;c0008860&gt;] (do_one_initcall+0x94/0x140)
[&lt;c0008860&gt;] (do_one_initcall) from [&lt;c037aadc&gt;] (kernel_init_freeable+0xe8/0x1b0)
[&lt;c037aadc&gt;] (kernel_init_freeable) from [&lt;c02730ac&gt;] (kernel_init+0x8/0xe4)
[&lt;c02730ac&gt;] (kernel_init) from [&lt;c00093f0&gt;] (ret_from_fork+0x14/0x24)
UBI: scanning is finished

Freeing the cache in the error path fixes the Slab error.

Tested on at91sam9g35 (3.14.18+fastmap backports)

Signed-off-by: Richard Genoud &lt;richard.genoud@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>UBI: Fix PEB leak in wear_leveling_worker()</title>
<updated>2013-09-27T00:18:01+00:00</updated>
<author>
<name>Richard Weinberger</name>
<email>richard@nod.at</email>
</author>
<published>2013-08-19T06:48:12+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=e7d63334e76b3cbb0ef599fef1643701fdb28aad'/>
<id>e7d63334e76b3cbb0ef599fef1643701fdb28aad</id>
<content type='text'>
commit 5ef4414f4bc26a19cfd5cd11aee9697a863e4d51 upstream.

get_peb_for_wl() removes the PEB from the free list.
If the WL subsystem detects that no wear leveling is needed
it cancels the operation and drops the gained PEB.
In this case we have to put the PEB back into the free list.

This issue was introduced with commit ed4b7021c
(UBI: remove PEB from free tree in get_peb_for_wl()).

Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Artem Bityutskiy &lt;artem.bityutskiy@linux.intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 5ef4414f4bc26a19cfd5cd11aee9697a863e4d51 upstream.

get_peb_for_wl() removes the PEB from the free list.
If the WL subsystem detects that no wear leveling is needed
it cancels the operation and drops the gained PEB.
In this case we have to put the PEB back into the free list.

This issue was introduced with commit ed4b7021c
(UBI: remove PEB from free tree in get_peb_for_wl()).

Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Signed-off-by: Artem Bityutskiy &lt;artem.bityutskiy@linux.intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'for-linus-20130301' of git://git.infradead.org/linux-mtd</title>
<updated>2013-03-03T00:33:54+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2013-03-03T00:33:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=48476df99894492a0f7239f2f3c9a2dde4ff38e2'/>
<id>48476df99894492a0f7239f2f3c9a2dde4ff38e2</id>
<content type='text'>
Pull MTD update from David Woodhouse:
 "Fairly unexciting MTD merge for 3.9:

   - misc clean-ups in the MTD command-line partitioning parser
     (cmdlinepart)
   - add flash locking support for STmicro chips serial flash chips, as
     well as for CFI command set 2 chips.
   - new driver for the ELM error correction HW module found in various
     TI chips, enable the OMAP NAND driver to use the ELM HW error
     correction
   - added number of new serial flash IDs
   - various fixes and improvements in the gpmi NAND driver
   - bcm47xx NAND driver improvements
   - make the mtdpart module actually removable"

* tag 'for-linus-20130301' of git://git.infradead.org/linux-mtd: (45 commits)
  mtd: map: BUG() in non handled cases
  mtd: bcm47xxnflash: use pr_fmt for module prefix in messages
  mtd: davinci_nand: Use managed resources
  mtd: mtd_torturetest can cause stack overflows
  mtd: physmap_of: Convert device allocation to managed devm_kzalloc()
  mtd: at91: atmel_nand: for PMECC, add code to check the ONFI parameter ECC requirement.
  mtd: atmel_nand: make pmecc-cap, pmecc-sector-size in dts is optional.
  mtd: atmel_nand: avoid to report an error when lookup table offset is 0.
  mtd: bcm47xxsflash: adjust names of bus-specific functions
  mtd: bcm47xxpart: improve probing of nvram partition
  mtd: bcm47xxpart: add support for other erase sizes
  mtd: bcm47xxnflash: register this as normal driver
  mtd: bcm47xxnflash: fix message
  mtd: bcm47xxsflash: register this as normal driver
  mtd: bcm47xxsflash: write number of written bytes
  mtd: gpmi: add sanity check for the ECC
  mtd: gpmi: set the Golois Field bit for mx6q's BCH
  mtd: devices: elm: Removes &lt;xx&gt; literals in elm DT node
  mtd: gpmi: fix a dereferencing freed memory error
  mtd: fix the wrong timeo for panic_nand_wait()
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull MTD update from David Woodhouse:
 "Fairly unexciting MTD merge for 3.9:

   - misc clean-ups in the MTD command-line partitioning parser
     (cmdlinepart)
   - add flash locking support for STmicro chips serial flash chips, as
     well as for CFI command set 2 chips.
   - new driver for the ELM error correction HW module found in various
     TI chips, enable the OMAP NAND driver to use the ELM HW error
     correction
   - added number of new serial flash IDs
   - various fixes and improvements in the gpmi NAND driver
   - bcm47xx NAND driver improvements
   - make the mtdpart module actually removable"

* tag 'for-linus-20130301' of git://git.infradead.org/linux-mtd: (45 commits)
  mtd: map: BUG() in non handled cases
  mtd: bcm47xxnflash: use pr_fmt for module prefix in messages
  mtd: davinci_nand: Use managed resources
  mtd: mtd_torturetest can cause stack overflows
  mtd: physmap_of: Convert device allocation to managed devm_kzalloc()
  mtd: at91: atmel_nand: for PMECC, add code to check the ONFI parameter ECC requirement.
  mtd: atmel_nand: make pmecc-cap, pmecc-sector-size in dts is optional.
  mtd: atmel_nand: avoid to report an error when lookup table offset is 0.
  mtd: bcm47xxsflash: adjust names of bus-specific functions
  mtd: bcm47xxpart: improve probing of nvram partition
  mtd: bcm47xxpart: add support for other erase sizes
  mtd: bcm47xxnflash: register this as normal driver
  mtd: bcm47xxnflash: fix message
  mtd: bcm47xxsflash: register this as normal driver
  mtd: bcm47xxsflash: write number of written bytes
  mtd: gpmi: add sanity check for the ECC
  mtd: gpmi: set the Golois Field bit for mx6q's BCH
  mtd: devices: elm: Removes &lt;xx&gt; literals in elm DT node
  mtd: gpmi: fix a dereferencing freed memory error
  mtd: fix the wrong timeo for panic_nand_wait()
  ...
</pre>
</div>
</content>
</entry>
</feed>
