Messages in this thread | | | From | Baokun Li <> | Subject | [PATCH -next V2 0/2] ubi: fix race between ctrl_cdev_ioctl and ubi_cdev_ioctl | Date | Wed, 3 Nov 2021 09:32:47 +0800 |
| |
The lock held by ctrl_cdev_ioctl is ubi_devices_mutex, but the lock held by ubi_cdev_ioctl is ubi->device_mutex. Therefore, the two locks can be concurrent.
ubi_attach_mtd_dev in ctrl_cdev_ioctl may be race with ubi_create_volume and ubi_remove_volume in ubi_cdev_ioctl. Because ubi_attach_mtd_dev has similar ubi_free_volume and ubi_open_volume. These two functions are called in uif_init and uif_close, and we'll fix both races in this patch set.
Another function in ctrl_cdev_ioctl, ubi_detach_mtd_dev, uses reference counting and ubi_devices_lock to avoid race in concurrency cases, so we do not need to fix it.
V1->V2: Add race in uif_close
Baokun Li (2): ubi: fix race between volume operations and uif_init ubi: fix race between volume operations and uif_close
drivers/mtd/ubi/build.c | 5 +++++ 1 file changed, 5 insertions(+)
-- 2.31.1
| |