Re: [PATCH 2/6] scsi: sr: release CDDA request before copying to userspace

[Yingjie Wang]

Hi Bart,

> This change triggers a use-after-free because blk_mq_free_request()
> calls bio_put(), isn't it?

I checked this on the series base, 0fcb05b72344. In this path,
blk_mq_free_request() releases the completed request. It does not put
the BIO chain saved from rq->bio; blk_rq_unmap_user() later walks that
chain and releases it.

sr_read_cdda_bpc() saves rq->bio before blk_execute_rq(). After
completion, the patch reads scmd->result and, when needed, normalizes
the sense data before freeing the request. After
blk_mq_free_request(), it only calls blk_rq_unmap_user(bio); neither rq
nor scmd is accessed again.

The same ownership split is used by sg_rq_end_io(), which frees the
request while retaining srp->bio for later unmapping. The deferred
completion branch of nvme_uring_cmd_end_io() also returns
RQ_END_IO_FREE while leaving pdu->bio to be unmapped in task work.

Based on this ownership, I do not see a use-after-free introduced by
patch 2/6. Please let me know if you had a different ownership path in
mind.

Thanks,
Yingjie