On Thu, Dec 10, 2020 at 10:44:54AM +0000, John Garry wrote: > Hi Ming, > > On 10/12/2020 02:07, Ming Lei wrote: > > > Apart from this, my concern is that we come with for a solution, but it's a > > > complicated solution and may not be accepted as this issue is not seen as a > > > problem in practice. > > If that is the case, I'd suggest to consider the solution in the > > following link: > > > > https://lore.kernel.org/linux-block/20200820180335.3109216-1-ming.lei@xxxxxxxxxx/ > > > > At least, the idea is simple, which can be extended to support allocate driver tags > > request pool dynamically. > > As I see with your approach, we may still iterate a stale request, but it > just has not been freed, so just no use-after-free BUG, right? Rather it is > cached until all references dropped. It may be best solution. The approach just need to read the stale request pointer, and won't access any field of that request, so no UAF. Yeah, the stale request won't be freed until when the reference from request pool is dropped. Thanks, Ming
