If ubifs_garbage_collect_leb() notes a LPT problem, empty LEB, but LPT has it makred as used, an ubifs_assert() is not enough. We have to abort GC. Otherwise list_entry() returns an invalid scan object and the kernel crashes.
c: <[email protected]> Fixes: 1e51764a3c2a ("UBIFS: add new flash file system") Signed-off-by: Richard Weinberger <[email protected]> --- fs/ubifs/gc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c index a03a47cf880d..11c09ce3c795 100644 --- a/fs/ubifs/gc.c +++ b/fs/ubifs/gc.c @@ -513,7 +513,13 @@ int ubifs_garbage_collect_leb(struct ubifs_info *c, struct ubifs_lprops *lp) if (IS_ERR(sleb)) return PTR_ERR(sleb); - ubifs_assert(!list_empty(&sleb->nodes)); + if (list_empty(&sleb->nodes)) { + ubifs_err(c, "Bad accouting information, LEB %i is marked as used but no nodes found!", + lnum); + dump_stack(); + return -EUCLEAN; + } + snod = list_entry(sleb->nodes.next, struct ubifs_scan_node, list); if (snod->type == UBIFS_IDX_NODE) { -- 2.18.0
