This series aims to tackle the various UAF reports, like: [0] https://lore.kernel.org/linux-block/[email protected]/ [1] https://lore.kernel.org/linux-block/[email protected]/T/#m6c1ac11540522716f645d004e2a5a13c9f218908 [2] https://lore.kernel.org/linux-block/[email protected]/ [3] https://lore.kernel.org/linux-block/[email protected]/
Details are in the commit messages. The issue addressed in patch 1/3 is pretty easy to reproduce, 2+3/3 not so much, and I had to add mdelays in the iters functions to recreate in sane timeframes. A regards patch 1/3, if 2+3/3 are adopted, then this can simplified to simply clear the tagset requests pointers without using any atomic operations. However, this patch on its own seems to solve the problem [3], above. So the other 2x patches are really for extreme scenarios which may never be seen in practice. As such, it could be considered to just accept patch 1/3 now. Differences to v2: - Add patch 2+3/3 - Drop patch to lockout blk_mq_queue_tag_busy_iter() when exiting elevator John Garry (3): blk-mq: Clean up references to old requests when freeing rqs blk-mq: Freeze and quiesce all queues for tagset in elevator_exit() blk-mq: Lockout tagset iterator when exiting elevator block/blk-mq-sched.c | 2 +- block/blk-mq-tag.c | 7 ++++++- block/blk-mq.c | 21 +++++++++++++++++++-- block/blk-mq.h | 2 ++ block/blk.h | 23 +++++++++++++++++++++++ include/linux/blk-mq.h | 1 + 6 files changed, 52 insertions(+), 4 deletions(-) -- 2.26.2
