Description of problem: Fix a cmd->ent use after free due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entry while another process running command flush flow takes refcount to this command entry. The process which handles commands flush may see this command as needed to be flushed if the other process allocated an ent->idx but didn't set ent to cmd->ent_arr in cmd_work_handler. Version-Release number of selected component (if applicable): Kernel version 5.10 How reproducible: This issue can be reproduced intermittently under heavy load conditions. Steps to Reproduce: 1. Run multiple command allocations and flush operations concurrently. 2. Monitor the use of cmd->ent and track refcount changes. 3. Observe if use-after-free error occurs during the process. Actual results: The system encounters a use-after-free error due to the race condition on command entry. Expected results: The command entry should be properly synchronized, avoiding the use-after-free error. Additional info: Fix it by moving the assignment of cmd->ent_arr into the spin lock. This change ensures the command entry is properly synchronized and avoids the use-after-free error.
The PR Link: https://gitee.com/anolis/cloud-kernel/pulls/3189
The PR Link: https://gitee.com/anolis/cloud-kernel/pulls/3203
The PR Link: https://gitee.com/anolis/cloud-kernel/pulls/3241