This series aims to tackle the various UAF reports, like: [0] https://lore.kernel.org/linux-block/8376443a-ec1b-0cef-8244-ed584b96fa96@xxxxxxxxxx/ [1] https://lore.kernel.org/linux-block/5c3ac5af-ed81-11e4-fee3-f92175f14daf@xxxxxxx/T/#m6c1ac11540522716f645d004e2a5a13c9f218908 [2] https://lore.kernel.org/linux-block/04e2f9e8-79fa-f1cb-ab23-4a15bf3f64cc@xxxxxxxxx/ [3] https://lore.kernel.org/linux-block/b859618aeac58bd9bb620d7ebdb24b90@xxxxxxxxxxxxxx/ Details are in the commit messages. The issue addressed in patch 1/3 is pretty easy to reproduce, 2+3/3 not so much, and I had to add mdelays in the iters functions to recreate in sane timeframes. A regards patch 1/3, if 2+3/3 are adopted, then this can simplified to simply clear the tagset requests pointers without using any atomic operations. However, this patch on its own seems to solve the problem [3], above. So the other 2x patches are really for extreme scenarios which may never be seen in practice. As such, it could be considered to just accept patch 1/3 now. Differences to v2: - Add patch 2+3/3 - Drop patch to lockout blk_mq_queue_tag_busy_iter() when exiting elevator John Garry (3): blk-mq: Clean up references to old requests when freeing rqs blk-mq: Freeze and quiesce all queues for tagset in elevator_exit() blk-mq: Lockout tagset iterator when exiting elevator block/blk-mq-sched.c | 2 +- block/blk-mq-tag.c | 7 ++++++- block/blk-mq.c | 21 +++++++++++++++++++-- block/blk-mq.h | 2 ++ block/blk.h | 23 +++++++++++++++++++++++ include/linux/blk-mq.h | 1 + 6 files changed, 52 insertions(+), 4 deletions(-) -- 2.26.2
