[PATCH v2 2/2] mtd/ftl: fix the double free of the buffers allocated in build_maps()

[Brian Norris]

On Thu, Jul 03, 2014 at 10:35:26AM +0800, Kevin Hao wrote:
> I got the following panic on my fsl p5020ds board.
> 
>   Unable to handle kernel paging request for data at address 0x7375627379737465
>   Faulting instruction address: 0xc000000000100778
>   Oops: Kernel access of bad area, sig: 11 [#1]
>   SMP NR_CPUS=24 CoreNet Generic
...
> It seems that the corrupted partition header on my mtd device triggers
> a bug in the ftl. In function build_maps() it will allocate the buffers
> needed by the mtd partition, but if something goes wrong such as kmalloc
> failure, mtd read error or invalid partition header parameter, it will
> free all allocated buffers and then return non-zero. In my case, it
> seems that partition header parameter 'NumTransferUnits' is invalid.
> 
> And the ftl_freepart() is a function which free all the partition
> buffers allocated by build_maps(). Given the build_maps() is a self
> cleaning function, so there is no need to invoke this function even
> if build_maps() return with error. Otherwise it will causes the
> buffers to be freed twice and then weird things would happen.
> 
> Cc: stable at vger.kernel.org
> Signed-off-by: Kevin Hao <haokexin at gmail.com>
> ---
> v2: Just update the commit log and add Cc stable.

Thanks for the updated description. Pushed to l2-mtd.git. Thanks!

Brian