[PATCH -next V2 0/2] ubi: fix race between ctrl_cdev_ioctl and ubi_cdev_ioctl
From: Baokun Li
Date: Tue Nov 02 2021 - 21:20:14 EST
The lock held by ctrl_cdev_ioctl is ubi_devices_mutex, but the lock held by
ubi_cdev_ioctl is ubi->device_mutex. Therefore, the two locks can be
concurrent.
ubi_attach_mtd_dev in ctrl_cdev_ioctl may be race with ubi_create_volume and
ubi_remove_volume in ubi_cdev_ioctl. Because ubi_attach_mtd_dev has similar
ubi_free_volume and ubi_open_volume. These two functions are called in
uif_init and uif_close, and we'll fix both races in this patch set.
Another function in ctrl_cdev_ioctl, ubi_detach_mtd_dev, uses reference
counting and ubi_devices_lock to avoid race in concurrency cases,
so we do not need to fix it.
V1->V2:
Add race in uif_close
Baokun Li (2):
ubi: fix race between volume operations and uif_init
ubi: fix race between volume operations and uif_close
drivers/mtd/ubi/build.c | 5 +++++
1 file changed, 5 insertions(+)
--
2.31.1