Re: [PATCH] bdi: fix use-after-free for bdi device

[Tejun Heo <tj@xxxxxxxxxx>]

Hello, Yufen.

On Tue, Feb 11, 2020 at 09:57:44PM +0800, Yufen Yu wrote:
> There is another simple way to fix the problem.
> 
> Since blkg_dev_name() have been coverd by rcu_read_lock/unlock(),
> we can wait all rcu reader to finish before free 'bdi->dev' to avoid use-after-free.
> 
> But I am not sure if this solution will introduce new problems.

So, I don't see why bdi->dev should be freed before bdi itself does.
Would something like the following work?

bdi_unregister()
{
        ...
        if (bdi->dev) {
                ...
                device_get(bdi->dev);   // to be put on release
                device_unregister(bdi->dev);
        }
        ...
}

release_bdi()
{
        ...
        if (bdi->dev) {
                // warn if dev is still registered
                device_put(bdi->dev);
        }
        ...
}

Thanks.

-- 
tejun