From: Lars Ellenberg <lars.ellenberg@linbit.com>
To: drbd-dev@lists.linbit.com
Subject: Re: [Drbd-dev] [PATCH] Fixed possible use after free in drbd_thread_setup
Date: Fri, 22 Dec 2017 15:50:52 +0100 [thread overview]
Message-ID: <20171222145052.GE4939@soda.linbit> (raw)
In-Reply-To: <1513878810-6207-1-git-send-email-johannes@johannesthoma.com>
On Thu, Dec 21, 2017 at 06:53:30PM +0100, johannes@johannesthoma.com wrote:
> drbd_thread might already be freed when complete returns,
The lifetime of our "struct drbd_tread" thingies, which are embeded in
our struct drbd_resource and struct drbd_connection,
is different from the "running" time of the threads.
So no, this won't happen.
> hence we shouldn't access the drbd_thread object (thi)
> after calling complete().
>
> I am not 100% sure if this creates any further races,
Moving that complete out of the spinlock would introduce
potential races between drbd_thread_setup, drbd_thread_start,
and _drbd_thread_stop, yes.
Lars
prev parent reply other threads:[~2017-12-22 14:59 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-21 17:53 [Drbd-dev] [PATCH] Fixed possible use after free in drbd_thread_setup johannes
2017-12-22 14:50 ` Lars Ellenberg [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171222145052.GE4939@soda.linbit \
--to=lars.ellenberg@linbit.com \
--cc=drbd-dev@lists.linbit.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox