Merge branch 'linux-next' of git://git.infradead.org/ubifs-2.6

* 'linux-next' of git://git.infradead.org/ubifs-2.6:
  UBI: fix use-after-free on error path
  UBI: fix missing scrub when there is a bit-flip
  UBIFS: Use kmemdup rather than duplicating its implementation

6 files changed, 19 insertions, 16 deletions

diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index fb7f19b62d9..cd26da8ad22 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -1028,12 +1028,14 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
          * 'ubi_wl_put_peb()' function on the @ubi->move_mutex. In turn, we are
          * holding @ubi->move_mutex and go sleep on the LEB lock. So, if the
          * LEB is already locked, we just do not move it and return
-         * %MOVE_CANCEL_RACE, which means that UBI will re-try, but later.
+         * %MOVE_RETRY. Note, we do not return %MOVE_CANCEL_RACE here because
+         * we do not know the reasons of the contention - it may be just a
+         * normal I/O on this LEB, so we want to re-try.
          */
         err = leb_write_trylock(ubi, vol_id, lnum);
         if (err) {
                 dbg_wl("contention on LEB %d:%d, cancel", vol_id, lnum);
-                return MOVE_CANCEL_RACE;
+                return MOVE_RETRY;
         }
 
         /*
diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
index dc64c767fd2..d51d75d3444 100644
--- a/drivers/mtd/ubi/ubi.h
+++ b/drivers/mtd/ubi/ubi.h
@@ -120,6 +120,7 @@ enum {
  *                     PEB
  * MOVE_CANCEL_BITFLIPS: canceled because a bit-flip was detected in the
  *                       target PEB
+ * MOVE_RETRY: retry scrubbing the PEB
  */
 enum {
         MOVE_CANCEL_RACE = 1,
@@ -127,6 +128,7 @@ enum {
         MOVE_TARGET_RD_ERR,
         MOVE_TARGET_WR_ERR,
         MOVE_CANCEL_BITFLIPS,
+        MOVE_RETRY,
 };
 
 /**
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 42c684cf368..0696e36b053 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -795,7 +795,10 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
                         protect = 1;
                         goto out_not_moved;
                 }
-
+                if (err == MOVE_RETRY) {
+                        scrubbing = 1;
+                        goto out_not_moved;
+                }
                 if (err == MOVE_CANCEL_BITFLIPS || err == MOVE_TARGET_WR_ERR ||
                     err == MOVE_TARGET_RD_ERR) {
                         /*
@@ -1049,7 +1052,6 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
 
         ubi_err("failed to erase PEB %d, error %d", pnum, err);
         kfree(wl_wrk);
-        kmem_cache_free(ubi_wl_entry_slab, e);
 
         if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
             err == -EBUSY) {
@@ -1062,14 +1064,16 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
                         goto out_ro;
                 }
                 return err;
-        } else if (err != -EIO) {
+        }
+
+        kmem_cache_free(ubi_wl_entry_slab, e);
+        if (err != -EIO)
                 /*
                  * If this is not %-EIO, we have no idea what to do. Scheduling
                  * this physical eraseblock for erasure again would cause
                  * errors again and again. Well, lets switch to R/O mode.
                  */
                 goto out_ro;
-        }
 
         /* It is %-EIO, the PEB went bad */
 
diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index 6189c74d97f..66d59d0a140 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -1986,12 +1986,11 @@ again:
 
                                 if (path[h].in_tree)
                                         continue;
-                                nnode = kmalloc(sz, GFP_NOFS);
+                                nnode = kmemdup(&path[h].nnode, sz, GFP_NOFS);
                                 if (!nnode) {
                                         err = -ENOMEM;
                                         goto out;
                                 }
-                                memcpy(nnode, &path[h].nnode, sz);
                                 parent = nnode->parent;
                                 parent->nbranch[nnode->iip].nnode = nnode;
                                 path[h].ptr.nnode = nnode;
@@ -2004,12 +2003,11 @@ again:
                                 const size_t sz = sizeof(struct ubifs_pnode);
                                 struct ubifs_nnode *parent;
 
-                                pnode = kmalloc(sz, GFP_NOFS);
+                                pnode = kmemdup(&path[h].pnode, sz, GFP_NOFS);
                                 if (!pnode) {
                                         err = -ENOMEM;
                                         goto out;
                                 }
-                                memcpy(pnode, &path[h].pnode, sz);
                                 parent = pnode->parent;
                                 parent->nbranch[pnode->iip].pnode = pnode;
                                 path[h].ptr.pnode = pnode;
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index 06673864768..e14ee53159d 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -344,12 +344,11 @@ static int lnc_add(struct ubifs_info *c, struct ubifs_zbranch *zbr,
                 return err;
         }
 
-        lnc_node = kmalloc(zbr->len, GFP_NOFS);
+        lnc_node = kmemdup(node, zbr->len, GFP_NOFS);
         if (!lnc_node)
                 /* We don't have to have the cache, so no error */
                 return 0;
 
-        memcpy(lnc_node, node, zbr->len);
         zbr->leaf = lnc_node;
         return 0;
 }
diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
index bf18f7a0454..85b27226875 100644
--- a/fs/ubifs/xattr.c
+++ b/fs/ubifs/xattr.c
@@ -138,12 +138,11 @@ static int create_xattr(struct ubifs_info *c, struct inode *host,
         ui = ubifs_inode(inode);
         ui->xattr = 1;
         ui->flags |= UBIFS_XATTR_FL;
-        ui->data = kmalloc(size, GFP_NOFS);
+        ui->data = kmemdup(value, size, GFP_NOFS);
         if (!ui->data) {
                 err = -ENOMEM;
                 goto out_free;
         }
-        memcpy(ui->data, value, size);
         inode->i_size = ui->ui_size = size;
         ui->data_len = size;
 
@@ -204,12 +203,11 @@ static int change_xattr(struct ubifs_info *c, struct inode *host,
                 return err;
 
         kfree(ui->data);
-        ui->data = kmalloc(size, GFP_NOFS);
+        ui->data = kmemdup(value, size, GFP_NOFS);
         if (!ui->data) {
                 err = -ENOMEM;
                 goto out_free;
         }
-        memcpy(ui->data, value, size);
         inode->i_size = ui->ui_size = size;
         ui->data_len = size;