Re: [PATCH v7 4/8] nbd: remove queue freeze in nbd_add_socket

在 2026/8/5 14:58, Yang Erkun 写道:

> nbd_add_socket() kreallocs config->socks, which a concurrent reader in
> nbd_handle_cmd() could UAF; commit b98e762e3d71 ("nbd: freeze the queue
> while we're adding connections")froze the queue to block that.  But the
> freeze costs an RCU grace period on every socket added, and setup adds
> them one by one.
>
> After the previous patch, nbd_add_socket() is rejected once nbd->pid is
> set, so it only runs during setup.  There the capacity is 0 and the
> write cache is off (cleared on disconnect by the preceding patch, and
> re-enabled only later in nbd_set_size), so submit_bio_noacct() rejects
> every bio before it reaches the driver -- non-zero-sector ones via
> bio_check_eod(), and flush-only ones via the !bdev_write_cache() branch.
> No I/O is in flight, so the freeze is unnecessary.
>
> Signed-off-by: Yang Erkun<[email protected]>
> ---
>   drivers/block/nbd.c | 9 ---------
>   1 file changed, 9 deletions(-)
Reviewed-by: Yu Kuai <[email protected]>

-- 
Thanks,
Kuai