Skip to content
Snippets Groups Projects
  1. Apr 25, 2016
  2. Apr 24, 2016
  3. Apr 22, 2016
    • Tom Rini's avatar
      65341967
    • Heiko Schocher's avatar
      ubifs: fix memory corruption in super.c · b1d6590d
      Heiko Schocher authored
      
      In list "super_blocks" ubifs collects allocated super_block
      structs. U-Boot frees on unmount the allocated struct,
      so the pointer stored in this list is free after the umount.
      On a new ubifs mount, the new allocated super_block struct
      get inserted into the super_blocks list ... which contains
      now a freed pointer, and the list_add_tail() corrupts the
      freed memory ...
      
      2 solutions are possible:
      - remove the super_block from the super_blocks list
        on umount
      
      - as U-Boot does not use the super_blocks list ...
        remove it complete for U-Boot.
      
      Both solutions should not introduce problems for porting
      to newer linux version, so this patch removes the unused
      super_blocks list, as it saves code size and execution
      time.
      
      Signed-off-by: default avatarHeiko Schocher <hs@denx.de>
      b1d6590d
Loading