[PATCH 4.9.y] ubi: Fix race condition between ubi volume creation and udev

[PATCH 4.9.y] ubi: Fix race condition between ubi volume creation and udev

[Clay McClure]

This is a conceptual cherry-pick of commit
a51a0c8d213594bc094cb8e54aad0cb6d7f7b9a6 upstream.

Similar to commit 714fb87e8bc0 ("ubi: Fix race condition between ubi
device creation and udev"), we should make the volume active before
registering it.

Signed-off-by: Clay McClure <clay@daemons.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Richard Weinberger <richard@nod.at>
(clay: massaged to apply to 4.9.y)
Signed-off-by: Clay McClure <clay@daemons.net>
---
Hello,

The race fixed by this upstream patch also occurs in 4.9, 4.4, and
at least as far back as 3.14 (where we originally found it). This
massaged patch applies cleanly to 4.9.y and 4.4.y and possibly to
earlier kernels.

Thanks,

Clay
---
 drivers/mtd/ubi/vmt.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
index 7ac78c13dd1c..1bcb25bc35ef 100644
--- a/drivers/mtd/ubi/vmt.c
+++ b/drivers/mtd/ubi/vmt.c
@@ -265,6 +265,12 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
 			vol->last_eb_bytes = vol->usable_leb_size;
 	}
 
+	/* Make volume "available" before it becomes accessible via sysfs */
+	spin_lock(&ubi->volumes_lock);
+	ubi->volumes[vol_id] = vol;
+	ubi->vol_count += 1;
+	spin_unlock(&ubi->volumes_lock);
+
 	/* Register character device for the volume */
 	cdev_init(&vol->cdev, &ubi_vol_cdev_operations);
 	vol->cdev.owner = THIS_MODULE;
@@ -304,11 +310,6 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
 	if (err)
 		goto out_sysfs;
 
-	spin_lock(&ubi->volumes_lock);
-	ubi->volumes[vol_id] = vol;
-	ubi->vol_count += 1;
-	spin_unlock(&ubi->volumes_lock);
-
 	ubi_volume_notify(ubi, vol, UBI_VOLUME_ADDED);
 	self_check_volumes(ubi);
 	return err;
@@ -328,6 +329,10 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
 out_cdev:
 	cdev_del(&vol->cdev);
 out_mapping:
+	spin_lock(&ubi->volumes_lock);
+	ubi->volumes[vol_id] = NULL;
+	ubi->vol_count -= 1;
+	spin_unlock(&ubi->volumes_lock);
 	if (do_free)
 		ubi_eba_destroy_table(eba_tbl);
 out_acc:
-- 
2.7.4

Re: [PATCH 4.9.y] ubi: Fix race condition between ubi volume creation and udev

[Greg KH]

On Wed, Feb 14, 2018 at 12:15:58PM -0800, Clay McClure wrote:
> This is a conceptual cherry-pick of commit
> a51a0c8d213594bc094cb8e54aad0cb6d7f7b9a6 upstream.
> 
> Similar to commit 714fb87e8bc0 ("ubi: Fix race condition between ubi
> device creation and udev"), we should make the volume active before
> registering it.
> 
> Signed-off-by: Clay McClure <clay@daemons.net>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Richard Weinberger <richard@nod.at>
> (clay: massaged to apply to 4.9.y)
> Signed-off-by: Clay McClure <clay@daemons.net>
> ---
> Hello,
> 
> The race fixed by this upstream patch also occurs in 4.9, 4.4, and
> at least as far back as 3.14 (where we originally found it). This
> massaged patch applies cleanly to 4.9.y and 4.4.y and possibly to
> earlier kernels.

I'd like to get an ack from Richard here to verify this is ok before
applying it.

thanks,

greg k-h