From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Richard Weinberger To: Ben Hutchings Cc: Martin Townsend , stable@vger.kernel.org, Greg Kroah-Hartman , LKML Subject: Re: [PATCH 4.4 23/97] ubi: fastmap: Dont flush fastmap work on detach Date: Wed, 16 May 2018 19:37:01 +0200 Message-ID: <2235171.AyZ2c50PG7@blindfold> In-Reply-To: <1526489629.9159.147.camel@codethink.co.uk> References: <20180422135304.577223025@linuxfoundation.org> <20180422135306.338619311@linuxfoundation.org> <1526489629.9159.147.camel@codethink.co.uk> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Sender: linux-kernel-owner@vger.kernel.org List-ID: Ben, Am Mittwoch, 16. Mai 2018, 18:53:49 CEST schrieb Ben Hutchings: > I don't see how this change can fix a use-after-free. If this function > can be called with *ubi already freed, then the rest of the function > body is also not safe to run. But I don't think that is the case. thanks a lot for digging into this! It is not about ubi (struct ubi_device) being free()'d, it is about ubi->volumes[]. > ubi->fm_work doesn't depend on any other structure (except a global > workqueue, which won't go away). > > It seems to me that the bug is really a race condition, and removing > the flush_work() makes it harder to hit that condition. The proper fix > would be to call flush_work() (or cancel_work_sync()) before the UBI > volumes are freed. That's a very valid point. I think cancel_work_sync() is the right thing to do. Thanks, //richard