Re: request_queue use-after-free - inode_detach_wb()

From	Tejun Heo <tj@kernel.org>
Newsgroups	linux.kernel
Subject	Re: request_queue use-after-free - inode_detach_wb()
Date	2015-11-19 22:20 +0100
Message-ID	<qwEMx-6ku-17@gated-at.bofh.it> (permalink)
References	(1 earlier) <qvVw7-1Ai-21@gated-at.bofh.it> <qwcGC-4D5-15@gated-at.bofh.it> <qwcZY-4Lu-27@gated-at.bofh.it> <qwd9E-4Pa-27@gated-at.bofh.it> <qwEtb-5WV-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hello, Ilya.

On Thu, Nov 19, 2015 at 09:56:21PM +0100, Ilya Dryomov wrote:
> > Yes, that's where *I* think we should be headed.  Stuff in lower
> > layers should stick around while upper layer things are around
> 
> I think the fundamental problem is the embedding of bdi in the queue.
> The lifetime rules (or, rather, expectations) for the two seem to be
> completely different and, while used together, they belong to different
> subsystems.  Even if we find a way to fix this particular race, there
> is a good chance someone will reintroduce it in the future, perhaps in
> a more subtle way.

You're right.  This is nasty.  Hmmm... the root problem is that beyond
the last __blkdev_put() the bdev and disk don't really have anything
to do with each other but the bdev is still pointing to it.  We are
already guaranteeing that the underlying disk hangs around while there
are bdevs associated with it.

We already know that the bdev is idle once bd_openers hits zero and
the inode gets flushed, so at that point, the problem is bdev's
inode->i_wb is still pointing to something that the bdev doesn't have
anything to do with.  So, can we do inode_detach_wb() after flushing
the inode?

Thanks.

-- 
tejun
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

Re: request_queue use-after-free - inode_detach_wb() Tejun Heo <tj@kernel.org> - 2015-11-17 22:00 +0100
  Re: request_queue use-after-free - inode_detach_wb() Ilya Dryomov <idryomov@gmail.com> - 2015-11-18 16:20 +0100
    Re: request_queue use-after-free - inode_detach_wb() Tejun Heo <tj@kernel.org> - 2015-11-18 16:40 +0100
      Re: request_queue use-after-free - inode_detach_wb() Ilya Dryomov <idryomov@gmail.com> - 2015-11-18 16:50 +0100
        Re: request_queue use-after-free - inode_detach_wb() Tejun Heo <tj@kernel.org> - 2015-11-18 17:00 +0100
        Re: request_queue use-after-free - inode_detach_wb() Ilya Dryomov <idryomov@gmail.com> - 2015-11-19 22:00 +0100
          Re: request_queue use-after-free - inode_detach_wb() Tejun Heo <tj@kernel.org> - 2015-11-19 22:20 +0100
            Re: request_queue use-after-free - inode_detach_wb() Ilya Dryomov <idryomov@gmail.com> - 2015-11-19 23:00 +0100
              Re: request_queue use-after-free - inode_detach_wb() Tejun Heo <tj@kernel.org> - 2015-11-19 23:20 +0100

csiph-web