All of lore.kernel.org
 help / color / mirror / Atom feed
From: Neill Kapron <nkapron@google.com>
To: Ingo Rohloff <ingo.rohloff@lauterbach.com>
Cc: gregkh@linuxfoundation.org, viro@zeniv.linux.org.uk,
	me@samcday.com, michael.bommarito@gmail.com,
	linux-usb@vger.kernel.org
Subject: Re: [PATCH 2/3] usb: gadget: f_fs: register cancellation handler only after request queueing
Date: Fri, 6 Nov 2026 22:47:48 +0000	[thread overview]
Message-ID: <au5ZFAei8LcpYNgY@google.com> (raw)
In-Reply-To: <20260901120908.14386-3-ingo.rohloff@lauterbach.com>

On Tue, Sep 01, 2026 at 02:09:07PM +0200, Ingo Rohloff wrote:
> Call kiocb_set_cancel_fn() only after usb_ep_queue() completes
> successfully.
> 
> This also undoes commit e78dcb1f7ec2 ("usb: gadget: f_fs: Fix
> Use-After-Free in AIO error path"): The described error is avoided by
> making sure the cancellation handler is only registered, if there is
> something to cancel.

Hi Ingo,

Unfortunately, I don't think this is safe. The cancel handler has to be
set before the request is queued. 

Moving the registration to just before usb_ep_queue() would close the
potential race, but if the queue fails, you still have to unwind- the
kiocb is already on active_reqs, so it has to be removed before io_data
is freed. 

That ends up more complex than what we have today, so I'm going to NAK
this patch.

Thanks,
Neill


  reply	other threads:[~2026-11-06 22:47 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-01 12:09 [PATCH 0/3] usb: gadget: f_fs: cancellation and mm fixes Ingo Rohloff
2026-09-01 12:09 ` [PATCH 1/3] usb: gadget: f_fs: simplify error handling using goto Ingo Rohloff
2026-11-06 23:13   ` Neill Kapron
2026-09-01 12:09 ` [PATCH 2/3] usb: gadget: f_fs: register cancellation handler only after request queueing Ingo Rohloff
2026-11-06 22:47   ` Neill Kapron [this message]
2026-11-09 11:31     ` Ingo Rohloff
2026-11-09 16:19       ` Ingo Rohloff
2026-09-01 12:09 ` [PATCH 3/3] usb: gadget: f_fs: Fix mmgrab()/mmdrop() balance Ingo Rohloff
2026-10-30  8:19   ` Hongyu Xie
2026-11-06 22:53   ` Neill Kapron

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=au5ZFAei8LcpYNgY@google.com \
    --to=nkapron@google.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=ingo.rohloff@lauterbach.com \
    --cc=linux-usb@vger.kernel.org \
    --cc=me@samcday.com \
    --cc=michael.bommarito@gmail.com \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.