Messages in this thread | | | Date | Thu, 19 Nov 2015 22:56:43 +0100 | Subject | Re: request_queue use-after-free - inode_detach_wb() | From | Ilya Dryomov <> |
| |
On Thu, Nov 19, 2015 at 10:18 PM, Tejun Heo <tj@kernel.org> wrote: > Hello, Ilya. > > On Thu, Nov 19, 2015 at 09:56:21PM +0100, Ilya Dryomov wrote: >> > Yes, that's where *I* think we should be headed. Stuff in lower >> > layers should stick around while upper layer things are around >> >> I think the fundamental problem is the embedding of bdi in the queue. >> The lifetime rules (or, rather, expectations) for the two seem to be >> completely different and, while used together, they belong to different >> subsystems. Even if we find a way to fix this particular race, there >> is a good chance someone will reintroduce it in the future, perhaps in >> a more subtle way. > > You're right. This is nasty. Hmmm... the root problem is that beyond > the last __blkdev_put() the bdev and disk don't really have anything > to do with each other but the bdev is still pointing to it. We are > already guaranteeing that the underlying disk hangs around while there > are bdevs associated with it. > > We already know that the bdev is idle once bd_openers hits zero and > the inode gets flushed, so at that point, the problem is bdev's > inode->i_wb is still pointing to something that the bdev doesn't have > anything to do with. So, can we do inode_detach_wb() after flushing > the inode?
Detaching the inode earlier is what I suggested in the first email, but I didn't know if this kind of special casing was OK. I'll try it out.
Thanks,
Ilya
| |