Merge tag 'ubi-for-2026.01-rc1' of https://source.denx.de/u-boot/custodians/u-boot-ubi

UBI updates for 2025.10

- ubi fixes found by Andrew with Smatch
  - mtd: ubi: Remove test that always fails
  - fs: ubifs: Ensure buf is freed before return
  - fs: ubifs: Need to check return for being an error pointer
  -fs: ubifs: Fix and rework error handling in ubifs_finddir

- fix: limit copy size in ubispl found by Benedikt

- extend support for LED activity (use the LED activity also on ubi reads)
  from Yegor

cmd/ubi.c

@@ -549,6 +549,7 @@ int ubi_volume_read(char *volume, char *buf, loff_t offset, size_t size)
 	}
 	len = size > tbuf_size ? tbuf_size : size;
 
+	led_activity_blink();
 	tmp = offp;
 	off = do_div(tmp, vol->usable_leb_size);
 	lnum = tmp;
@@ -582,6 +583,7 @@ int ubi_volume_read(char *volume, char *buf, loff_t offset, size_t size)
 		env_set_hex("filesize", len_read);
 
 	free(tbuf);
+	led_activity_off();
 	return err;
 }
 
@@ -600,7 +602,9 @@ static int ubi_dev_scan(struct mtd_info *info, const char *vid_header_offset)
 	if (err)
 		return -err;
 
+	led_activity_blink();
 	err = ubi_init();
+	led_activity_off();
 	if (err)
 		return -err;
 

drivers/mtd/ubi/io.c

@@ -936,12 +936,7 @@ static int validate_vid_hdr(const struct ubi_device *ubi,
 				ubi_err(ubi, "bad data_size");
 				goto bad;
 			}
-		} else if (lnum == used_ebs - 1) {
-			if (data_size == 0) {
-				ubi_err(ubi, "bad data_size at last LEB");
-				goto bad;
-			}
-		} else {
+		} else if (lnum != used_ebs - 1) {
 			ubi_err(ubi, "too high lnum");
 			goto bad;
 		}

drivers/mtd/ubispl/ubispl.c

@@ -779,7 +779,7 @@ static int ubi_scan_fastmap(struct ubi_scan_info *ubi,
 		 * that already so we merily copy it over.
 		 */
 		if (pnum == fm_anchor)
-			memcpy(vh, ubi->blockinfo + pnum, sizeof(*fm));
+			memcpy(vh, ubi->blockinfo + pnum, sizeof(*vh));
 
 		if (i == 0) {
 			if (be32_to_cpu(vh->vol_id) != UBI_FM_SB_VOLUME_ID) {

fs/ubifs/lprops.c

@@ -1096,14 +1096,16 @@ static int scan_check_cb(struct ubifs_info *c,
 		lst->empty_lebs += 1;
 		lst->total_free += c->leb_size;
 		lst->total_dark += ubifs_calc_dark(c, c->leb_size);
-		return LPT_SCAN_CONTINUE;
+		ret = LPT_SCAN_CONTINUE;
+		goto out;
 	}
 	if (lp->free + lp->dirty == c->leb_size &&
 	    !(lp->flags & LPROPS_INDEX)) {
 		lst->total_free  += lp->free;
 		lst->total_dirty += lp->dirty;
 		lst->total_dark  +=  ubifs_calc_dark(c, c->leb_size);
-		return LPT_SCAN_CONTINUE;
+		ret = LPT_SCAN_CONTINUE;
+		goto out;
 	}
 
 	sleb = ubifs_scan(c, lnum, 0, buf, 0);

fs/ubifs/super.c

@@ -2425,7 +2425,7 @@ retry:
 	if (!s) {
 		spin_unlock(&sb_lock);
 		s = alloc_super(type, flags);
-		if (!s)
+		if (IS_ERR_OR_NULL(s))
 			return ERR_PTR(-ENOMEM);
 #ifndef __UBOOT__
 		goto retry;

fs/ubifs/ubifs.c

@@ -420,7 +420,6 @@ out:
 static int ubifs_finddir(struct super_block *sb, char *dirname,
 			 unsigned long root_inum, unsigned long *inum)
 {
-	int err;
 	struct qstr nm;
 	union ubifs_key key;
 	struct ubifs_dent_node *dent;
@@ -435,8 +434,8 @@ static int ubifs_finddir(struct super_block *sb, char *dirname,
 	dir = kzalloc(sizeof(struct inode), 0);
 	if (!file || !dentry || !dir) {
 		printf("%s: Error, no memory for malloc!\n", __func__);
-		err = -ENOMEM;
-		goto out;
+		ret = -ENOMEM;
+		goto out_free;
 	}
 
 	dir->i_sb = sb;
@@ -453,7 +452,7 @@ static int ubifs_finddir(struct super_block *sb, char *dirname,
 	nm.name = NULL;
 	dent = ubifs_tnc_next_ent(c, &key, &nm);
 	if (IS_ERR(dent)) {
-		err = PTR_ERR(dent);
+		ret = PTR_ERR(dent);
 		goto out;
 	}
 
@@ -481,7 +480,7 @@ static int ubifs_finddir(struct super_block *sb, char *dirname,
 		nm.name = (char *)dent->name;
 		dent = ubifs_tnc_next_ent(c, &key, &nm);
 		if (IS_ERR(dent)) {
-			err = PTR_ERR(dent);
+			ret = PTR_ERR(dent);
 			goto out;
 		}
 
@@ -492,11 +491,12 @@ static int ubifs_finddir(struct super_block *sb, char *dirname,
 	}
 
 out:
-	if (err != -ENOENT)
-		dbg_gen("cannot find next direntry, error %d", err);
+	if (ret < 0 && ret != -ENOENT)
+		dbg_gen("cannot find next direntry, error %d", ret);
 
 out_free:
-	kfree(file->private_data);
+	if (file)
+		kfree(file->private_data);
 	free(file);
 	free(dentry);
 	free(dir);