[PATCH -next V2 0/2] ubi: fix race between ctrl_cdev_ioctl and ubi_cdev_ioctl

[Baokun Li]

The lock held by ctrl_cdev_ioctl is ubi_devices_mutex, but the lock held by
ubi_cdev_ioctl is ubi->device_mutex. Therefore, the two locks can be
concurrent.

ubi_attach_mtd_dev in ctrl_cdev_ioctl may be race with ubi_create_volume and
ubi_remove_volume in ubi_cdev_ioctl. Because ubi_attach_mtd_dev has similar
ubi_free_volume and ubi_open_volume. These two functions are called in
uif_init and uif_close, and we'll fix both races in this patch set.

Another function in ctrl_cdev_ioctl, ubi_detach_mtd_dev, uses reference
counting and ubi_devices_lock to avoid race in concurrency cases,
so we do not need to fix it.

V1->V2:
	Add race in uif_close

Baokun Li (2):
  ubi: fix race between volume operations and uif_init
  ubi: fix race between volume operations and uif_close

 drivers/mtd/ubi/build.c | 5 +++++
 1 file changed, 5 insertions(+)

-- 
2.31.1