Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Richard Weinberger <richard@nod.at>
To:     Ben Hutchings <ben.hutchings@codethink.co.uk>
Cc:     Martin Townsend <mtownsend1973@gmail.com>, stable@vger.kernel.org,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 4.4 23/97] ubi: fastmap: Dont flush fastmap work on detach
Date:   Wed, 16 May 2018 19:37:01 +0200
Message-ID: <2235171.AyZ2c50PG7@blindfold>
In-Reply-To: <1526489629.9159.147.camel@codethink.co.uk>
References: <20180422135304.577223025@linuxfoundation.org> <20180422135306.338619311@linuxfoundation.org> <1526489629.9159.147.camel@codethink.co.uk>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Ben,

Am Mittwoch, 16. Mai 2018, 18:53:49 CEST schrieb Ben Hutchings:
> I don't see how this change can fix a use-after-free.  If this function
> can be called with *ubi already freed, then the rest of the function
> body is also not safe to run.  But I don't think that is the case.

thanks a lot for digging into this!
It is not about ubi (struct ubi_device) being free()'d, it is about
ubi->volumes[].

> ubi->fm_work doesn't depend on any other structure (except a global
> workqueue, which won't go away).
> 
> It seems to me that the bug is really a race condition, and removing
> the flush_work() makes it harder to hit that condition.  The proper fix
> would be to call flush_work() (or cancel_work_sync()) before the UBI
> volumes are freed.

That's a very valid point.
I think cancel_work_sync() is the right thing to do.

Thanks,
//richard