On Thu, Apr 29, 2021 at 10:34:54AM +0800, Ming Lei wrote: > Hi Jens, > > This patchset fixes the request UAF issue by one simple approach, > without clearing ->rqs[] in fast path. > > 1) grab request's ref before calling ->fn in blk_mq_tagset_busy_iter, > and release it after calling ->fn, so ->fn won't be called for one > request if its queue is frozen, done in 2st patch > > 2) clearing any stale request referred in ->rqs[] before freeing the > request pool, one per-tags spinlock is added for protecting > grabbing request ref vs. clearing ->rqs[tag], so UAF by refcount_inc_not_zero > in bt_tags_iter() is avoided, done in 3rd patch. > > > V4: > - remove hctx->fq-flush_rq from tags->rqs[] before freeing hw queue, > patch 4/4 is added, which is based on David's patch. Hello Jens, Any chance to merge the patch to 5.13 if you are fine? Thanks, Ming
