Re: [PATCH 6/6] loop: don't add worker into idle list
From: Dan Schatzberg <hidden>
Date: 2021-07-08 14:41:40
On Thu, Jul 08, 2021 at 02:58:36PM +0800, Ming Lei wrote:
quoted hunk ↗ jump to hunk
diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 146eaa03629b..3cd51bddfec9 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c@@ -980,7 +980,6 @@ static struct loop_worker *loop_alloc_or_get_worker(struct loop_device *lo, static void loop_release_worker(struct loop_worker *worker) { - xa_erase(&worker->lo->workers, worker->blkcg_css->id); css_put(worker->blkcg_css); kfree(worker);
Another thought - do you need to change the kfree here to kfree_rcu? I'm concerned about the scenario where loop_queue_work's xa_load finds the worker and subsequently __loop_free_idle_workers erases and calls loop_release_worker. If the worker is freed then the subsequent refcount_inc_not_zero in loop_queue_work would be a use after free.