Ben,
Am Mittwoch, 16. Mai 2018, 18:53:49 CEST schrieb Ben Hutchings:
I don't see how this change can fix a use-after-free. If this function can be called with *ubi already freed, then the rest of the function body is also not safe to run. But I don't think that is the case.
thanks a lot for digging into this! It is not about ubi (struct ubi_device) being free()'d, it is about ubi->volumes[].
ubi->fm_work doesn't depend on any other structure (except a global workqueue, which won't go away).
It seems to me that the bug is really a race condition, and removing the flush_work() makes it harder to hit that condition. The proper fix would be to call flush_work() (or cancel_work_sync()) before the UBI volumes are freed.
That's a very valid point. I think cancel_work_sync() is the right thing to do.
Thanks, //richard