diff options
| author | Richard Weinberger <richard@nod.at> | 2014-10-02 15:00:35 +0200 |
|---|---|---|
| committer | Richard Weinberger <richard@nod.at> | 2015-03-26 21:24:24 +0100 |
| commit | d59f21bebe9d0fda34027ff1afda4f2b0d5f1869 (patch) | |
| tree | 4825c6a28771521a6eeff4e926d9b5a39ed7011a /drivers/mtd/ubi/ubi.h | |
| parent | UBI: Fastmap: Ensure that all fastmap work is done upon WL shutdown (diff) | |
| download | linux-d59f21bebe9d0fda34027ff1afda4f2b0d5f1869.tar.xz linux-d59f21bebe9d0fda34027ff1afda4f2b0d5f1869.zip | |
UBI: Fastmap: Fix races in ubi_wl_get_peb()
ubi_wl_get_peb() has two problems, it reads the pool
size and usage counters without any protection.
While reading one value would be perfectly fine it reads multiple
values and compares them. This is racy and can lead to incorrect
pool handling.
Furthermore ubi_update_fastmap() is called without wl_lock held,
before incrementing the used counter it needs to be checked again.
It could happen that another thread consumed all PEBs from the
pool and the counter goes beyond ->size.
Signed-off-by: Richard Weinberger <richard@nod.at>
Diffstat (limited to 'drivers/mtd/ubi/ubi.h')
| -rw-r--r-- | drivers/mtd/ubi/ubi.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h index 7a33470c0416..bc13d14e02c4 100644 --- a/drivers/mtd/ubi/ubi.h +++ b/drivers/mtd/ubi/ubi.h @@ -443,7 +443,8 @@ struct ubi_debug_info { * @pq_head: protection queue head * @wl_lock: protects the @used, @free, @pq, @pq_head, @lookuptbl, @move_from, * @move_to, @move_to_put @erase_pending, @wl_scheduled, @works, - * @erroneous, @erroneous_peb_count, and @fm_work_scheduled fields + * @erroneous, @erroneous_peb_count, @fm_work_scheduled, @fm_pool, + * and @fm_wl_pool fields * @move_mutex: serializes eraseblock moves * @work_sem: used to wait for all the scheduled works to finish and prevent * new works from being submitted |