Re: [PATCH] Fix a use-after-free triggered by device removal

[Bart Van Assche <bvanassche@acm.org>]

On 09/11/12 01:38, Tejun Heo wrote:
> On Fri, Sep 07, 2012 at 08:57:10AM +0200, Bart Van Assche wrote:
>> Also, as far as I can see the functions that can insert a request into
>> the queue (blk_insert_cloned_request(), queue_unplugged(),
>> blk_execute_rq_nowait()) all check whether the queue is dead before
>> inserting a request. That should be sufficient to prevent that new
>> requests are queued after QUEUE_FLAG_DEAD has been set.
> 
> Yes, but does that guarantee that none would call into ->request_fn()?
> If so, fine; otherwise, we may need to add another state to prevent
> that.

Good question. As far as I can see calling request_queue.request_fn() is
fine as long as the caller holds a reference on the queue. If e.g.
scsi_request_fn() would get invoked after blk_drain_queue() finished it
will return immediately because it was invoked with an empty request
queue. So we should be fine as long as all blk_run_queue() callers
either hold a reference on the request queue itself or on the sdev that
owns the request queue. As far as I can see if patch
http://marc.info/?l=linux-scsi&m=134453905402413 gets accepted then all
callers in the SCSI core of blk_run_queue() will hold a (direct or
indirect) reference on the request_queue before invoking blk_run_queue()
or __blk_run_queue().

Bart.