• Heiko Schocher's avatar
    ubifs: fix memory corruption in super.c · b1d6590d
    Heiko Schocher authored
    In list "super_blocks" ubifs collects allocated super_block
    structs. U-Boot frees on unmount the allocated struct,
    so the pointer stored in this list is free after the umount.
    On a new ubifs mount, the new allocated super_block struct
    get inserted into the super_blocks list ... which contains
    now a freed pointer, and the list_add_tail() corrupts the
    freed memory ...
    2 solutions are possible:
    - remove the super_block from the super_blocks list
      on umount
    - as U-Boot does not use the super_blocks list ...
      remove it complete for U-Boot.
    Both solutions should not introduce problems for porting
    to newer linux version, so this patch removes the unused
    super_blocks list, as it saves code size and execution
    Signed-off-by: default avatarHeiko Schocher <hs@denx.de>
super.c 66.8 KB