Re: [PATCH v2 03/10] blktrace: fix debugfs use after free

[Luis Chamberlain]

On Wed, Apr 22, 2020 at 05:43:20PM +0800, Ming Lei wrote:
> On Wed, Apr 22, 2020 at 07:28:59AM +0000, Luis Chamberlain wrote:
> > At this point in time patch-wise we still haven't reverted back to
> > synchronous request_queue removal. Considering this, a race with the
> > parent disappearing can happen because the request_queue removal is
> > deferred, that is, the request_queue's kobject's release() call used
> > schedule_work() to finish off its removal. We expect the last
> > blk_put_queue() to be called at the end of blk_cleanup_queue(). Since
> 
> Actually no, we expect that request queue is released after disk is
> released. Don't forget that gendisk does hold one extra refcount of
> request queue.

Then by all means using blk_put_queue() from everywhere should be safe
in atomic context, as we have control over that blk_put_queue() on the
block layer.

(Modulo, we accept the races possible today on blk_get_queue(), which
I'll try to address).

  Luis