linux-kernel - [PATCH -next V2 0/2] ubi: fix race between ctrl_cdev_ioctl and ubi_cdev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 3 Nov 2021 09:32:47 +0800
From:   Baokun Li <libaokun1@...wei.com>
To:     <richard@....at>, <miquel.raynal@...tlin.com>, <vigneshr@...com>,
        <linux-mtd@...ts.infradead.org>, <linux-kernel@...r.kernel.org>
CC:     <patchwork@...wei.com>, <libaokun1@...wei.com>,
        <yukuai3@...wei.com>, <chengzhihao1@...wei.com>
Subject: [PATCH -next V2 0/2] ubi: fix race between ctrl_cdev_ioctl and ubi_cdev_ioctl

The lock held by ctrl_cdev_ioctl is ubi_devices_mutex, but the lock held by
ubi_cdev_ioctl is ubi->device_mutex. Therefore, the two locks can be
concurrent.

ubi_attach_mtd_dev in ctrl_cdev_ioctl may be race with ubi_create_volume and
ubi_remove_volume in ubi_cdev_ioctl. Because ubi_attach_mtd_dev has similar
ubi_free_volume and ubi_open_volume. These two functions are called in
uif_init and uif_close, and we'll fix both races in this patch set.

Another function in ctrl_cdev_ioctl, ubi_detach_mtd_dev, uses reference
counting and ubi_devices_lock to avoid race in concurrency cases,
so we do not need to fix it.

V1->V2:
	Add race in uif_close

Baokun Li (2):
  ubi: fix race between volume operations and uif_init
  ubi: fix race between volume operations and uif_close

 drivers/mtd/ubi/build.c | 5 +++++
 1 file changed, 5 insertions(+)

-- 
2.31.1