Hi all,
I seem to be running into a double free error with
ubi_volume_desc/ubi_close_volume during a ubifsmount/ubifsload/ubifsumount
sequence.
This is the sequence that I'm seeing:
ubifsmount
- do_ubifs_mount
- cmd_ubifs_mount
- uboot_ubifs_mount
- ubifs_mount
- open_ubi
- ubi_open_volume -> returns ubi_volume_desc #1
- open_ubi returns ubi_volume_desc #1
- ubi_volume_desc #1 stored in local ubi variable
- ubifs_fill_super
- ubi_open_volume returns ubi_volume_desc #2
- ubi_volume_desc #2 stored in sb->s_fs_info->ubi
- ubi_close_volume(ubi) i.e. ubi_close_volume(ubi_volume_desc #1)
- kfree(ubi_volume_desc #1)
- sb stored in global ubifs_sb (including ubi_volume_desc #2)
ubifsload
- do_ubifs_load
- ubifs_load
- ubifs_read
- ubi_open_volume -> returns ubi_volume_desc #3
- ubi_volume_desc #3 stored in ubifs_sb->s_fs_info->ubi (this overwrites
ubi_volume_desc #2!)
- ubi_close_volume(ubifs_sb->s_fs_info->ubi) i.e.
ubi_close_volume(ubi_volume_desc #3)
- kfree(ubi_volume_desc #3)
ubifsumount
- do_ubifs_umount
- cmd_ubifs_umount
- uboot_ubifs_umount
- ubifs_umount(ubifs_sb->s_fs_info)
- ubi_close_volume(ubifs_sb->s_fs_info->ubi) i.e.
ubi_close_volume(ubi_volume_desc #3)
- kfree(ubi_volume_desc #3)
- this is a double free error, ubi_volume_desc #2 should be closed
instead (but the reference has been lost)!
The issue seems to be that ubifs_read overwrites the ubi_volume_desc that's
stored in the superblock, and thus ubi_volume_desc #2 is never freed, while
ubi_volume_desc #3 is freed twice.
I'm not sure what the correct behaviour should be:
- should the volume be closed at the end of ubifs_mount, or stay open until
ubifs_umount?
- should ubifs_read not open the volume if it is already open?
Thanks in advance!
Regards,
Felix
