1 files changed, 20 insertions, 9 deletions

diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
index 5c90dec5db0b..62a38d9c55e9 100644
--- a/fs/ubifs/lpt_commit.c
+++ b/fs/ubifs/lpt_commit.c
@@ -1628,29 +1628,35 @@ static int dbg_check_ltab_lnum(struct ubifs_info *c, int lnum)
 {
         int err, len = c->leb_size, dirty = 0, node_type, node_num, node_len;
         int ret;
-        void *buf = c->dbg->buf;
+        void *buf, *p;
 
         if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
                 return 0;
 
+        buf = p = __vmalloc(c->leb_size, GFP_KERNEL | GFP_NOFS, PAGE_KERNEL);
+        if (!buf) {
+                ubifs_err("cannot allocate memory for ltab checking");
+                return 0;
+        }
+
         dbg_lp("LEB %d", lnum);
         err = ubi_read(c->ubi, lnum, buf, 0, c->leb_size);
         if (err) {
                 dbg_msg("ubi_read failed, LEB %d, error %d", lnum, err);
-                return err;
+                goto out;
         }
         while (1) {
-                if (!is_a_node(c, buf, len)) {
+                if (!is_a_node(c, p, len)) {
                         int i, pad_len;
 
-                        pad_len = get_pad_len(c, buf, len);
+                        pad_len = get_pad_len(c, p, len);
                         if (pad_len) {
-                                buf += pad_len;
+                                p += pad_len;
                                 len -= pad_len;
                                 dirty += pad_len;
                                 continue;
                         }
-                        if (!dbg_is_all_ff(buf, len)) {
+                        if (!dbg_is_all_ff(p, len)) {
                                 dbg_msg("invalid empty space in LEB %d at %d",
                                         lnum, c->leb_size - len);
                                 err = -EINVAL;
@@ -1668,16 +1674,21 @@ static int dbg_check_ltab_lnum(struct ubifs_info *c, int lnum)
                                         lnum, dirty, c->ltab[i].dirty);
                                 err = -EINVAL;
                         }
-                        return err;
+                        goto out;
                 }
-                node_type = get_lpt_node_type(c, buf, &node_num);
+                node_type = get_lpt_node_type(c, p, &node_num);
                 node_len = get_lpt_node_len(c, node_type);
                 ret = dbg_is_node_dirty(c, node_type, lnum, c->leb_size - len);
                 if (ret == 1)
                         dirty += node_len;
-                buf += node_len;
+                p += node_len;
                 len -= node_len;
         }
+
+        err = 0;
+out:
+        vfree(buf);
+        return err;
 }
 
 /**