Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATH v2] scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach
To:     yebin <yebin10@huawei.com>, jejb@linux.ibm.com,
        martin.petersen@oracle.com, linux-scsi@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <20210113063103.2698953-1-yebin10@huawei.com>
 <a1113b04-e320-a12b-5a59-ec7479d5eec1@acm.org> <61016887.9000200@huawei.com>
From:   Bart Van Assche <bvanassche@acm.org>
Message-ID: <1a86eadf-41fe-256e-2656-b9a13f73d88f@acm.org>
Date:   Wed, 28 Jul 2021 14:55:19 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.12.0
MIME-Version: 1.0
In-Reply-To: <61016887.9000200@huawei.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Precedence: bulk

On 7/28/21 7:24 AM, yebin wrote:
> On 2021/7/23 12:04, Bart Van Assche wrote:
>> On 1/12/21 10:31 PM, Ye Bin wrote:
>>>       sdev->handler_data = NULL;
>>> +    synchronize_rcu();
>>>       kfree(h);
>> What is the purpose of the new synchronize_rcu() call?
> Thanks for your reply.
> Yes, I add new synchronize_rcu() call is to wait until *h is no longer 
> in use. If free
> "h" right now , mybe lead to UAF.
>> If its purpose is
>> to wait until *h is no longer in use, please use kfree_rcu() instead.
> struct rdac_dh_data {
>          struct list_head        node;
>          .....
> }
> As rdac_dh_data.node type is "struct list_head", but  kfree_rcu the 
> first parameter type is
> "struct rcu_head". So we can only use synchronize_rcu() at here.

Ah, that's right. Hence:

Reviewed-by: Bart Van Assche <bvanassche@acm.org>