Re: [PATCH] Fix a use-after-free triggered by device removal

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

On Fri, Sep 07, 2012 at 08:57:10AM +0200, Bart Van Assche wrote:
> I'm not sure it would be a good idea to add a blk_queue_dead() check in
> any of the __blk_run_queue() variants since blk_drain_queue() can invoke
> __blk_run_queue() to drain the queue.

Right, we can't cancel requests from block layer which were already
seen by the driver.

> Also, as far as I can see the functions that can insert a request into
> the queue (blk_insert_cloned_request(), queue_unplugged(),
> blk_execute_rq_nowait()) all check whether the queue is dead before
> inserting a request. That should be sufficient to prevent that new
> requests are queued after QUEUE_FLAG_DEAD has been set.

Yes, but does that guarantee that none would call into ->request_fn()?
If so, fine; otherwise, we may need to add another state to prevent
that.

Thanks.

-- 
tejun
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]
  Powered by Linux