Re: [PATCH] block: Fix use after free in blockdev_mark_auto_del()

2023-05-03 Thread Stefan Hajnoczi
On Wed, May 03, 2023 at 04:01:42PM +0200, Kevin Wolf wrote: > job_cancel_locked() drops the job list lock temporarily and it may call > aio_poll(). We must assume that the list has changed after this call. > Also, with unlucky timing, it can end up freeing the job during >

[PATCH] block: Fix use after free in blockdev_mark_auto_del()

2023-05-03 Thread Kevin Wolf
job_cancel_locked() drops the job list lock temporarily and it may call aio_poll(). We must assume that the list has changed after this call. Also, with unlucky timing, it can end up freeing the job during job_completed_txn_abort_locked(), making the job pointer invalid, too. For both reasons, we