Re: [PATCH] bdi: fix use-after-free for bdi device

[Tejun Heo <tj@kernel.org>]

Hello,

On Thu, Feb 13, 2020 at 10:46:34AM +0800, Yufen Yu wrote:
> For each time of register, bdi_register() will try to create a new 'dev'.
> 
> bdi_register
>     bdi_register_va
>         if (bdi->dev) // if bdi->dev is not NULL, return directly
>             return 0;
>         dev = device_create_vargs()...
> 
> So, I think freeing bdi->dev until bdi itself does may be a problem
> for drivers that supported re-registration bdi, such as:

Ugh, thanks for noticing that. I guess the right thing to do is then
going full RCU. What do you think about expanding your previous patch
so that ->dev has __rcu annotation, users use the RCU accessors and
the device is destroyed asynchronously through call_rcu()?

Thanks.

-- 
tejun