On Mon, Dec 11, 2017 at 10:11:29PM -0500, Martin K. Petersen wrote: > > Hi Ming, > > > This patch allocates one array for T10_PI_TYPE2_PROTECTION command, > > size of each element is SD_EXT_CDB_SIZE, and the length is > > host->can_queue, then we can retrieve one command buffer runtime > > via rq->tag. > > > > So we can avoid to allocate the command buffer runtime, also the > > recent use-after-free report[1] in scsi_show_rq() can be fixed too. > > I'm still mulling over the pros and cons of this one for 4.16+... Hi Martin, This patch can't work in case of real multiple hw queues, but can be fixed without much work. Even we can convert the big allocation into page by page allocation if there is case of huge tag space. Anyway if you think this approach is good, please let me know, and I am happy to cook V2 for review. Thanks, Ming