Re: [PATCH v6] loop: Fix NULL pointer dereference in lo_rw_aio()

[Bart Van Assche]

On 8/25/26 8:13 AM, Tetsuo Handa wrote:
> On 2026/08/25 7:53, Bart Van Assche wrote:
> > A correction: it is not safe to call drain_workqueue() nor to freeze the
> > request queue in __loop_clr_fd(). I'm considering to modify the comment
> > in that function as follows:
>
> you also recognized that we can't call drain_workqueue() or flush_workqueue().
>
> Therefore, I chose to temporarily drop lo->lo_disk->open_mutex in order to
> make it possible to safely perform drain_workqueue().

My sentence was incomplete: I should have written that it is not safe to
call drain_workqueue() nor flush_workqueue() from __loop_clr_fd() while
the request queue is frozen. It is not clear to me how draining or
flushing the workqueue from inside __loop_clr_fd() could cause trouble
if this happens with the queue unfrozen since disk->open_mutex is not
acquired by the memory reclaim code?

Thanks,

Bart.