lkml.org 
[lkml]   [2018]   [May]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH 4.4 23/97] ubi: fastmap: Dont flush fastmap work on detach
    Date
    Ben,

    Am Mittwoch, 16. Mai 2018, 18:53:49 CEST schrieb Ben Hutchings:
    > I don't see how this change can fix a use-after-free. If this function
    > can be called with *ubi already freed, then the rest of the function
    > body is also not safe to run. But I don't think that is the case.

    thanks a lot for digging into this!
    It is not about ubi (struct ubi_device) being free()'d, it is about
    ubi->volumes[].

    > ubi->fm_work doesn't depend on any other structure (except a global
    > workqueue, which won't go away).
    >
    > It seems to me that the bug is really a race condition, and removing
    > the flush_work() makes it harder to hit that condition. The proper fix
    > would be to call flush_work() (or cancel_work_sync()) before the UBI
    > volumes are freed.

    That's a very valid point.
    I think cancel_work_sync() is the right thing to do.

    Thanks,
    //richard

    \
     
     \ /
      Last update: 2018-05-16 19:37    [W:3.288 / U:1.656 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site