Re: [PATCH] bdi: fix use-after-free for bdi device

[Jan Kara <jack@suse.cz>]

On Thu 20-02-20 19:07:01, Yufen Yu wrote:
> Hi,
> 
> On 2020/2/19 20:55, Jan Kara wrote:
> > Hi!
> > 
> > On Sat 15-02-20 21:54:08, Yufen Yu wrote:
> 
> > 
> > I've now noticed there's commit 68f23b8906 "memcg: fix a crash in wb_workfn
> > when a device disappears" from end of January which tries to address the
> > issue you're looking into. Now AFAIU the code is till somewhat racy after
> > that commit so I wanted to mention this mostly so that you fixup also the
> > new bdi_dev_name() while you're fixing blkg_dev_name().
> > 
> > Also I was wondering about one thing: If we really care about bdi->dev only
> > for the name, won't we be much better off with just copying the name to
> > bdi->name on registration? Sure it would consume a bit of memory for the
> > name copy but I don't think we really care and things would be IMO *much*
> > simpler that way... Yufen, Tejun, what do you think?
> > 
> 
> I think copying the name to bdi->name is also need protected by lock.
> Otherwise, the reader of bdi->name may read incorrect value when
> re-registion have not copy the name completely. Right? So, I also think
> using RCU to protect object lifetimes may be a better way.

OK, fair enough. :)

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR