Re: [PATCH] SUNRPC: fix use-after-free of rpc pipes

[Stanislav Kinsbursky <skinsbursky@parallels.com>]

27.02.2012 17:44, Myklebust, Trond пишет:
> On Mon, 2012-02-27 at 16:51 +0400, Stanislav Kinsbursky wrote:
>> Frankly, I don't like the idea of put'ing pipe data on dentry unlink. IOW, I
>> don't like that this data will be controlled somehow in PipeFS.
>> I'll send my version soon.
>>
>
> I don't understand that objection. The lifetime of that data needs to be
> bounded by the lifetime of the pipe itself, which means that it _has_ to
> be controlled by the pipefs.
>
> BTW: it isn't being put on dentry unlink. It is being put on dentry
> _destruction_. Those are two different events (which is why we have a
> problem today).
>

Please, have a look at "SUNRPC: several fixes around PipeFS objects" patch set.
Briefly, pipe data is created on some kernel event (mount or module install), 
while PipeFS dentry/inode is created on user-space event (PipeFS mount/umount 
request). Thus this two objects are created independently.
And I believe, that they have to be destroyed independently too.

-- 
Best regards,
Stanislav Kinsbursky