evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "scsi: ufs_test: fix use after free issue"

Browse source
This commit is contained in:
Linux Build Service Account 2016-10-06 12:26:00 -07:00 • committed by Gerrit - the friendly Code Review server
commit 2b421b1a28
1 changed files with 9 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
drivers/scsi/ufs/ufs_test.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved. /* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and * it under the terms of the GNU General Public License version 2 and
@ -689,13 +689,13 @@ static void scenario_free_end_io_fn(struct request *rq, int err)
__blk_put_request(test_iosched->req_q, test_rq->rq); __blk_put_request(test_iosched->req_q, test_rq->rq);
spin_unlock_irqrestore(&test_iosched->lock, flags); spin_unlock_irqrestore(&test_iosched->lock, flags);
test_iosched_free_test_req_data_buffer(test_rq);
kfree(test_rq);
if (err) if (err)
pr_err("%s: request %d completed, err=%d", __func__, pr_err("%s: request %d completed, err=%d", __func__,
test_rq->req_id, err); test_rq->req_id, err);
test_iosched_free_test_req_data_buffer(test_rq);
kfree(test_rq);
check_test_completion(test_iosched); check_test_completion(test_iosched);
} }
@ -984,14 +984,14 @@ static void long_test_free_end_io_fn(struct request *rq, int err)
return; return;
} }
test_iosched_free_test_req_data_buffer(test_rq);
kfree(test_rq);
utd->completed_req_count++;
if (err) if (err)
pr_err("%s: request %d completed, err=%d", __func__, pr_err("%s: request %d completed, err=%d", __func__,
test_rq->req_id, err); test_rq->req_id, err);
test_iosched_free_test_req_data_buffer(test_rq);
kfree(test_rq);
utd->completed_req_count++;
check_test_completion(test_iosched); check_test_completion(test_iosched);
} }
@ -1007,7 +1007,7 @@ static void long_test_free_end_io_fn(struct request *rq, int err)
static int run_long_test(struct test_iosched *test_iosched) static int run_long_test(struct test_iosched *test_iosched)
{ {
int ret = 0; int ret = 0;
int direction, num_bios_per_request; int direction, num_bios_per_request = 1;
static unsigned int inserted_requests; static unsigned int inserted_requests;
u32 sector, seed, num_bios, seq_sector_delta; u32 sector, seed, num_bios, seq_sector_delta;
struct ufs_test_data *utd = test_iosched->blk_dev_test_data; struct ufs_test_data *utd = test_iosched->blk_dev_test_data;
@ -1028,14 +1028,12 @@ static int run_long_test(struct test_iosched *test_iosched)
/* Set test parameters */ /* Set test parameters */
switch (test_iosched->test_info.testcase) { switch (test_iosched->test_info.testcase) {
case UFS_TEST_LONG_RANDOM_READ: case UFS_TEST_LONG_RANDOM_READ:
num_bios_per_request = 1;
utd->long_test_num_reqs = (utd->sector_range * SECTOR_SIZE) / utd->long_test_num_reqs = (utd->sector_range * SECTOR_SIZE) /
(LONG_RAND_TEST_REQ_RATIO * TEST_BIO_SIZE * (LONG_RAND_TEST_REQ_RATIO * TEST_BIO_SIZE *
num_bios_per_request); num_bios_per_request);
direction = READ; direction = READ;
break; break;
case UFS_TEST_LONG_RANDOM_WRITE: case UFS_TEST_LONG_RANDOM_WRITE:
num_bios_per_request = 1;
utd->long_test_num_reqs = (utd->sector_range * SECTOR_SIZE) / utd->long_test_num_reqs = (utd->sector_range * SECTOR_SIZE) /
(LONG_RAND_TEST_REQ_RATIO * TEST_BIO_SIZE * (LONG_RAND_TEST_REQ_RATIO * TEST_BIO_SIZE *
num_bios_per_request); num_bios_per_request);