On 2019/7/4 下午5:20, Stefano Garzarella wrote:

quoted

quoted

quoted

This is still suspicious, can we access the_virtio_vsock through vdev->priv?
If yes, we may still get use-after-free since it was not protected by RCU.

We will free the object only after calling the del_vqs(), so we are sure
that the vq_callbacks ended and will no longer be invoked.
So, IIUC it shouldn't happen.

Yes, but any dereference that is not done in vq_callbacks will be very
dangerous in the future.

Right.

Do you think make sense to continue with this series in order to fix the
hot-unplug issue, then I'll work to refactor the driver code to use the refcnt
(as you suggested in patch 2) and singleton for the_virtio_vsock?

Thanks,
Stefano

Yes.

Thanks