Re: [PATCH] Fix a use-after-free triggered by device removal

[Tejun Heo <tj@kernel.org>]

Hello, Bart.

On Thu, Sep 13, 2012 at 09:26:59AM +0200, Bart Van Assche wrote:
> On 09/12/12 22:53, Tejun Heo wrote:
> > The problem at hand IIUC is ->request_fn() being invoked when
> > request_queue itself is alive but the underlying driver is gone.  We
> > already make sure that a new request is not queued once drain is
> > complete but there's no guarantee about calling into ->request_fn()
> > and this is what you want to fix, right?
> 
> Actually it's a slightly different issue that I want to address, namely
> that with the current implementation of the block layer and the SCSI
> core it's possible that blk_cleanup_queue() finishes after
> scsi_request_fn() has unlocked the queue lock and before it obtains the
> queue lock again.
> 
> The reason I'm proposing to add a counter in the block layer and not in
> the SCSI core is because I think it would be useful for other
> request-based block drivers too to be able to unlock the queue inside
> their ->request_fn(). That would allow to reduce lock contention on the
> request_queue lock for low-latency block drivers.

Oh yeah, I definitely think this is something which needs to be solved
from the block layer but I'm hoping this could cover the case Chanho
is trying to solve too.  They're different but similar problems - you
don't want blk_cleanup_queue() to finish while someone is executing
inside it and you don't want anyone to enter it after
blk_cleanup_queue() is finished, so I really think we should have
block layer solution which fixes both problems.  That should be
possible, right?

Thanks.

-- 
tejun