MIME-Version: 1.0
References: <20230313090002.3308025-1-zyytlz.wz@163.com> <ZA8rDCw+mJmyETEx@localhost.localdomain>
 <20230313143054.538565ac@kernel.org>
In-Reply-To: <20230313143054.538565ac@kernel.org>
From:   Zheng Hacker <hackerzheng666@gmail.com>
Date:   Tue, 14 Mar 2023 09:07:02 +0800
Message-ID: <CAJedcCwXhrkfVOHz-+N=qZxP465JJ0wSJG37ppOAFNfDt0ABqQ@mail.gmail.com>
Subject: Re: [PATCH net v2] 9p/xen : Fix use after free bug in
 xen_9pfs_front_remove due to race condition
To:     Jakub Kicinski <kuba@kernel.org>
Cc:     Michal Swiatkowski <michal.swiatkowski@linux.intel.com>,
        Zheng Wang <zyytlz.wz@163.com>, ericvh@gmail.com,
        lucho@ionkov.net, asmadeus@codewreck.org, linux_oss@crudebyte.com,
        davem@davemloft.net, edumazet@google.com, pabeni@redhat.com,
        v9fs-developer@lists.sourceforge.net, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, 1395428693sheep@gmail.com,
        alex000young@gmail.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Jakub Kicinski <kuba@kernel.org> =E4=BA=8E2023=E5=B9=B43=E6=9C=8814=E6=97=
=A5=E5=91=A8=E4=BA=8C 05:30=E5=86=99=E9=81=93=EF=BC=9A
>
> On Mon, 13 Mar 2023 14:54:20 +0100 Michal Swiatkowski wrote:
> > > @@ -274,12 +274,17 @@ static const struct xenbus_device_id xen_9pfs_f=
ront_ids[] =3D {
> > >  static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv)
> > >  {
> > >     int i, j;
> > > +   struct xen_9pfs_dataring *ring =3D NULL;
> > Move it before int i, j to have RCT.
> >
> > >
> > >     write_lock(&xen_9pfs_lock);
> > >     list_del(&priv->list);
> > >     write_unlock(&xen_9pfs_lock);
> > >
> > >     for (i =3D 0; i < priv->num_rings; i++) {
> > > +           /*cancel work*/
> > It isn't needed I think, the function cancel_work_sync() tells everythi=
ng
> > here.
>
> Note that 9p is more storage than networking, so this patch is likely
> to go via a different tree than us.

Sorry I got confused.

Best regards,
Zheng