On 2019/7/4 下午5:20, Stefano Garzarella wrote:
This is still suspicious, can we access the_virtio_vsock through vdev->priv?
If yes, we may still get use-after-free since it was not protected by RCU.
We will free the object only after calling the del_vqs(), so we are sure
that the vq_callbacks ended and will no longer be invoked.
So, IIUC it shouldn't happen.
Yes, but any dereference that is not done in vq_callbacks will be very
dangerous in the future.
Right.
Do you think make sense to continue with this series in order to fix the
hot-unplug issue, then I'll work to refactor the driver code to use the refcnt
(as you suggested in patch 2) and singleton for the_virtio_vsock?
Thanks,
Stefano
Yes.
Thanks
