[PATCH -next] ubi: fix race between ctrl_cdev_ioctl and ubi_cdev_ioctl

[Zhihao Cheng]

在 2021/11/1 9:37, Baokun Li 写道:
Hi, Baokun
> diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
> index a7e3eb9befb6..708b1b96de01 100644
> --- a/drivers/mtd/ubi/build.c
> +++ b/drivers/mtd/ubi/build.c
> @@ -467,6 +467,7 @@ static int uif_init(struct ubi_device *ubi)
>   	if (err)
>   		goto out_unreg;
>   
> +	spin_lock(&ubi->volumes_lock);
>   	for (i = 0; i < ubi->vtbl_slots; i++)
>   		if (ubi->volumes[i]) {
>   			err = ubi_add_volume(ubi, ubi->volumes[i]);
> @@ -475,11 +476,13 @@ static int uif_init(struct ubi_device *ubi)
>   				goto out_volumes;
>   			}
>   		}
> +	spin_unlock(&ubi->volumes_lock);
>   
>   	return 0;
>   
>   out_volumes:
>   	kill_volumes(ubi);
> +	spin_unlock(&ubi->volumes_lock);
>   	cdev_device_del(&ubi->cdev, &ubi->dev);
>   out_unreg:
>   	unregister_chrdev_region(ubi->cdev.dev, ubi->vtbl_slots + 1);

There still exist one place that ubi_attach_mtd_dev() may race with 
ubi_remove_volume():

ubi->bgt_thread = kthread_create(ubi_thread, ubi, "%s", ubi->bgt_name)

     goto out_debugfs;

...

out_debugfs:

     ubi_debugfs_exit_dev(ubi);

out_uif:

    uif_close(ubi);      // Another process does ioctl to remove volume, 
which may cause volume double free.