linux-kernel - Re: [PATCH 2/8] blk-mq: change the method of iterating busy tags of a request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e17f86f0-98ca-5c79-0d9b-43c628b72413@oracle.com>
Date:   Mon, 18 Mar 2019 09:49:33 +0800
From:   "jianchao.wang" <jianchao.w.wang@...cle.com>
To:     Keith Busch <kbusch@...nel.org>
Cc:     "axboe@...nel.dk" <axboe@...nel.dk>,
        "linux-block@...r.kernel.org" <linux-block@...r.kernel.org>,
        "jsmart2021@...il.com" <jsmart2021@...il.com>,
        "bvanassche@....org" <bvanassche@....org>,
        "josef@...icpanda.com" <josef@...icpanda.com>,
        "linux-nvme@...ts.infradead.org" <linux-nvme@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "Busch, Keith" <keith.busch@...el.com>,
        "hare@...e.de" <hare@...e.de>,
        "jthumshirn@...e.de" <jthumshirn@...e.de>,
        "hch@....de" <hch@....de>, "sagi@...mberg.me" <sagi@...mberg.me>
Subject: Re: [PATCH 2/8] blk-mq: change the method of iterating busy tags of a
 request_queue

Hi Keith

On 3/16/19 12:16 AM, Keith Busch wrote:
> There is still a window where the check may succeed, but the request is
> being assigned to a completely different request_queue. The callback
> then operates on a request it doesn't own.
> 
> Tag iteration from a driver can be safe only if the driver initiates a
> freeze and quiesced all queues sharing the same tagset first. The nvme
> driver does that, but I think there may need to be an additional grace
> period to wait for the allocation's queue_enter to call queue_exit to
> ensure the request is initialized through blk_mq_rq_ctx_init().

This patch is to avoid the use-after-free case in the comment.
The helper interface is used in following cases,
1. in flight request account
   this case should not require so much accuracy

2. timeout check
   a extra reference will be held there to avoid the request recycle

3. if it is used by driver, it should be enough that quiesce the request_queue
   the driver usually wants to handle the in-flight ones, quiesce request_queue
   could ensure all of tasks quit the hctx_lock and no one issue request any
   more.

Thanks
Jianchao