From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1161678AbbKSVSg (ORCPT ); Thu, 19 Nov 2015 16:18:36 -0500 Received: from mail-yk0-f181.google.com ([209.85.160.181]:34814 "EHLO mail-yk0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758661AbbKSVSe (ORCPT ); Thu, 19 Nov 2015 16:18:34 -0500 Date: Thu, 19 Nov 2015 16:18:31 -0500 From: Tejun Heo To: Ilya Dryomov Cc: Christoph Hellwig , "linux-kernel@vger.kernel.org" , linux-fsdevel@vger.kernel.org, Ceph Development Subject: Re: request_queue use-after-free - inode_detach_wb() Message-ID: <20151119211831.GA4885@mtj.duckdns.org> References: <20151117205641.GF22864@mtj.duckdns.org> <20151118153039.GA11496@mtj.duckdns.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, Ilya. On Thu, Nov 19, 2015 at 09:56:21PM +0100, Ilya Dryomov wrote: > > Yes, that's where *I* think we should be headed. Stuff in lower > > layers should stick around while upper layer things are around > > I think the fundamental problem is the embedding of bdi in the queue. > The lifetime rules (or, rather, expectations) for the two seem to be > completely different and, while used together, they belong to different > subsystems. Even if we find a way to fix this particular race, there > is a good chance someone will reintroduce it in the future, perhaps in > a more subtle way. You're right. This is nasty. Hmmm... the root problem is that beyond the last __blkdev_put() the bdev and disk don't really have anything to do with each other but the bdev is still pointing to it. We are already guaranteeing that the underlying disk hangs around while there are bdevs associated with it. We already know that the bdev is idle once bd_openers hits zero and the inode gets flushed, so at that point, the problem is bdev's inode->i_wb is still pointing to something that the bdev doesn't have anything to do with. So, can we do inode_detach_wb() after flushing the inode? Thanks. -- tejun