From 75b7ef1caf19d467ee8a7e69eb5eccb6a45e1715 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Fri, 1 Aug 2025 12:49:48 +0100 Subject: [PATCH 1/6] mtd: ubi: Remove test that always fails When checking the VID header of a static volume there is an early test for data_size == 0 so testing for that condition again is guaranteed to fail. Just remove this piece of code. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/mtd/ubi/io.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c index 45699b4a477..2ec968c85ff 100644 --- a/drivers/mtd/ubi/io.c +++ b/drivers/mtd/ubi/io.c @@ -936,12 +936,7 @@ static int validate_vid_hdr(const struct ubi_device *ubi, ubi_err(ubi, "bad data_size"); goto bad; } - } else if (lnum == used_ebs - 1) { - if (data_size == 0) { - ubi_err(ubi, "bad data_size at last LEB"); - goto bad; - } - } else { + } else if (lnum != used_ebs - 1) { ubi_err(ubi, "too high lnum"); goto bad; } From 88e7a462f05d88bf3b782c3d06903b9cd1c19430 Mon Sep 17 00:00:00 2001 From: Benedikt Spranger Date: Wed, 17 Sep 2025 11:14:17 +0200 Subject: [PATCH 2/6] drivers/mtd/ubispl/ubispl.c: limit copy size The fastmap VID header is embedded in struct ubi_scan_info. During fastmap scan, the header is copied into struct ubi_scan_info, if valid. The former code mixed up the amount of copied bytes and copied more bytes than nessesary. This had no side effect, since the affected struct members are uninitialized at that point and overwritten later. Limit the copied bytes to the VID header size. Signed-off-by: Benedikt Spranger Reported-by: Andrew Goodbody --- drivers/mtd/ubispl/ubispl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/ubispl/ubispl.c b/drivers/mtd/ubispl/ubispl.c index 9face5fae15..0143caa051d 100644 --- a/drivers/mtd/ubispl/ubispl.c +++ b/drivers/mtd/ubispl/ubispl.c @@ -779,7 +779,7 @@ static int ubi_scan_fastmap(struct ubi_scan_info *ubi, * that already so we merily copy it over. */ if (pnum == fm_anchor) - memcpy(vh, ubi->blockinfo + pnum, sizeof(*fm)); + memcpy(vh, ubi->blockinfo + pnum, sizeof(*vh)); if (i == 0) { if (be32_to_cpu(vh->vol_id) != UBI_FM_SB_VOLUME_ID) { From 2bc0837ce19c64af44ccb912fc9c9e3a52269dec Mon Sep 17 00:00:00 2001 From: Yegor Yefremov Date: Thu, 2 Oct 2025 13:35:50 +0200 Subject: [PATCH 3/6] ubi: extend support for LED activity Add LED activity for ubi_dev_scan() and ubi_volume_read() routines. Signed-off-by: Yegor Yefremov --- cmd/ubi.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/cmd/ubi.c b/cmd/ubi.c index 56d7da82629..93de6f3aea2 100644 --- a/cmd/ubi.c +++ b/cmd/ubi.c @@ -549,6 +549,7 @@ int ubi_volume_read(char *volume, char *buf, loff_t offset, size_t size) } len = size > tbuf_size ? tbuf_size : size; + led_activity_blink(); tmp = offp; off = do_div(tmp, vol->usable_leb_size); lnum = tmp; @@ -582,6 +583,7 @@ int ubi_volume_read(char *volume, char *buf, loff_t offset, size_t size) env_set_hex("filesize", len_read); free(tbuf); + led_activity_off(); return err; } @@ -600,7 +602,9 @@ static int ubi_dev_scan(struct mtd_info *info, const char *vid_header_offset) if (err) return -err; + led_activity_blink(); err = ubi_init(); + led_activity_off(); if (err) return -err; From d23ddd5dee570e625e0fd76bba1e155f4cc1248c Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Fri, 3 Oct 2025 11:42:50 +0100 Subject: [PATCH 4/6] fs: ubifs: Ensure buf is freed before return Returning directly after buf has been allocated will result in a memory leak. Instead set the error code and goto the common unwind code to ensure that buf will be freed before returning. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- fs/ubifs/lprops.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/ubifs/lprops.c b/fs/ubifs/lprops.c index a9e22abe6b4..74beb853b6e 100644 --- a/fs/ubifs/lprops.c +++ b/fs/ubifs/lprops.c @@ -1096,14 +1096,16 @@ static int scan_check_cb(struct ubifs_info *c, lst->empty_lebs += 1; lst->total_free += c->leb_size; lst->total_dark += ubifs_calc_dark(c, c->leb_size); - return LPT_SCAN_CONTINUE; + ret = LPT_SCAN_CONTINUE; + goto out; } if (lp->free + lp->dirty == c->leb_size && !(lp->flags & LPROPS_INDEX)) { lst->total_free += lp->free; lst->total_dirty += lp->dirty; lst->total_dark += ubifs_calc_dark(c, c->leb_size); - return LPT_SCAN_CONTINUE; + ret = LPT_SCAN_CONTINUE; + goto out; } sleb = ubifs_scan(c, lnum, 0, buf, 0); From 51615eb4f7bcd3367aecdeaea3638058ef5407f3 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Fri, 3 Oct 2025 11:42:51 +0100 Subject: [PATCH 5/6] fs: ubifs: Need to check return for being an error pointer The return value from alloc_super can be an error pointer so the error check needs to detect this as well as checking the pointer for being NULL. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- fs/ubifs/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c index 7718081f093..b6004b88f4e 100644 --- a/fs/ubifs/super.c +++ b/fs/ubifs/super.c @@ -2425,7 +2425,7 @@ retry: if (!s) { spin_unlock(&sb_lock); s = alloc_super(type, flags); - if (!s) + if (IS_ERR_OR_NULL(s)) return ERR_PTR(-ENOMEM); #ifndef __UBOOT__ goto retry; From 0cab29ff467e297064a9fc30200347bda06ee0c4 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Fri, 3 Oct 2025 11:42:52 +0100 Subject: [PATCH 6/6] fs: ubifs: Fix and rework error handling in ubifs_finddir Add a null check for 'file' before dereferencing it and also rework the error handling to be a bit more sane. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- fs/ubifs/ubifs.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/fs/ubifs/ubifs.c b/fs/ubifs/ubifs.c index 398b076d783..40bad0e7da7 100644 --- a/fs/ubifs/ubifs.c +++ b/fs/ubifs/ubifs.c @@ -420,7 +420,6 @@ out: static int ubifs_finddir(struct super_block *sb, char *dirname, unsigned long root_inum, unsigned long *inum) { - int err; struct qstr nm; union ubifs_key key; struct ubifs_dent_node *dent; @@ -435,8 +434,8 @@ static int ubifs_finddir(struct super_block *sb, char *dirname, dir = kzalloc(sizeof(struct inode), 0); if (!file || !dentry || !dir) { printf("%s: Error, no memory for malloc!\n", __func__); - err = -ENOMEM; - goto out; + ret = -ENOMEM; + goto out_free; } dir->i_sb = sb; @@ -453,7 +452,7 @@ static int ubifs_finddir(struct super_block *sb, char *dirname, nm.name = NULL; dent = ubifs_tnc_next_ent(c, &key, &nm); if (IS_ERR(dent)) { - err = PTR_ERR(dent); + ret = PTR_ERR(dent); goto out; } @@ -481,7 +480,7 @@ static int ubifs_finddir(struct super_block *sb, char *dirname, nm.name = (char *)dent->name; dent = ubifs_tnc_next_ent(c, &key, &nm); if (IS_ERR(dent)) { - err = PTR_ERR(dent); + ret = PTR_ERR(dent); goto out; } @@ -492,11 +491,12 @@ static int ubifs_finddir(struct super_block *sb, char *dirname, } out: - if (err != -ENOENT) - dbg_gen("cannot find next direntry, error %d", err); + if (ret < 0 && ret != -ENOENT) + dbg_gen("cannot find next direntry, error %d", ret); out_free: - kfree(file->private_data); + if (file) + kfree(file->private_data); free(file); free(dentry); free(dir);