Re: [PATCH v6 6/6] blktrace: fix debugfs use after free

[Christoph Hellwig]

On Wed, Jun 10, 2020 at 11:31:16PM +0000, Luis Chamberlain wrote:
> On Wed, Jun 10, 2020 at 09:52:13PM +0000, Luis Chamberlain wrote:
> > diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
> > index 7ff2ea5cd05e..5cea04c05e09 100644
> > --- a/kernel/trace/blktrace.c
> > +++ b/kernel/trace/blktrace.c
> > @@ -524,10 +524,16 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
> >  	if (!bt->msg_data)
> >  		goto err;
> >  
> > -	ret = -ENOENT;
> > -
> > -	dir = debugfs_lookup(buts->name, blk_debugfs_root);
> > -	if (!dir)
> > +	/*
> > +	 * When tracing whole make_request drivers (multiqueue) block devices,
> > +	 * reuse the existing debugfs directory created by the block layer on
> > +	 * init. For request-based block devices, all partitions block devices,
> > +	 * and scsi-generic block devices we create a temporary new debugfs
> > +	 * directory that will be removed once the trace ends.
> > +	 */
> > +	if (queue_is_mq(q))
> 
> And this should be instead:
> 
> if (queue_is_mq(q) && bdev && bdev == bdev->bd_contains)

Yes.  But I think keeping the queue_is_mq out and always creating the
debugfs dir is an improvement as we'll sooner or later grow more debugfs
files and than the whole set of problmes reappears.  But I'd be fine
with doing the above in the first patch that is tiny and backportable,
and then have another patch that always creates the debugfs directory.