UBI: fix a horrible memory deallocation bug

commit 78b495c39add820ab66ab897af9bd77a5f2e91f6 upstream

UBI was mistakingly using 'kfree()' instead of 'kmem_cache_free()' when
freeing "attach eraseblock" structures in vtbl.c. Thankfully, this happened
only when we were doing auto-format, so many systems were unaffected. However,
there are still many users affected.

It is strange, but the system did not crash and nothing bad happened when
the SLUB memory allocator was used. However, in case of SLOB we observed an
crash right away.

This problem was introduced in 2.6.39 by commit
"6c1e875 UBI: add slab cache for ubi_scan_leb objects"

Reported-by: Richard Genoud <richard.genoud@gmail.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
index fd3bf770f518552265a22e254c08b47a34aa2dcf..326bd9375638a41028b3c7dc10fc2cd460299cb3 100644 (file)
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -356,7 +356,7 @@ static int create_vtbl(struct ubi_device *ubi, struct ubi_scan_info *si,
         */
        err = ubi_scan_add_used(ubi, si, new_seb->pnum, new_seb->ec,
                                vid_hdr, 0);
-       kfree(new_seb);
+       kmem_cache_free(si->scan_leb_slab, new_seb);
        ubi_free_vid_hdr(ubi, vid_hdr);
        return err;
 
@@ -369,7 +369,7 @@ static int create_vtbl(struct ubi_device *ubi, struct ubi_scan_info *si,
                list_add(&new_seb->u.list, &si->erase);
                goto retry;
        }
-       kfree(new_seb);
+       kmem_cache_free(si->scan_leb_slab, new_seb);
 out_free:
        ubi_free_vid_hdr(ubi, vid_hdr);
        return err;