From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754136AbbJ0HEM (ORCPT ); Tue, 27 Oct 2015 03:04:12 -0400 Received: from metis.ext.4.pengutronix.de ([92.198.50.35]:40211 "EHLO metis.ext.pengutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753973AbbJ0HEK (ORCPT ); Tue, 27 Oct 2015 03:04:10 -0400 Date: Tue, 27 Oct 2015 08:03:51 +0100 From: Markus Pargmann To: Christoph Hellwig Cc: Oleg Nesterov , Andrew Morton , Tejun Heo , nbd-general@lists.sourceforge.net, linux-kernel@vger.kernel.org Subject: Re: [PATCH 1/1] kthread: introduce kthread_get_run() to fix __nbd_ioctl() Message-ID: <20151027070351.GB25728@pengutronix.de> References: <20151025142655.GA30961@redhat.com> <20151025142713.GA30965@redhat.com> <20151027002642.GA32444@infradead.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="jho1yZJdad60DJr+" Content-Disposition: inline In-Reply-To: <20151027002642.GA32444@infradead.org> X-Sent-From: Pengutronix Hildesheim X-URL: http://www.pengutronix.de/ X-IRC: #ptxdist @freenode X-Accept-Language: de,en X-Accept-Content-Type: text/plain X-Uptime: 07:47:59 up 37 days, 20:09, 119 users, load average: 0.42, 0.52, 0.53 User-Agent: Mutt/1.5.24 (2015-08-30) X-SA-Exim-Connect-IP: 2001:67c:670:100:1d::7 X-SA-Exim-Mail-From: mpa@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: linux-kernel@vger.kernel.org Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --jho1yZJdad60DJr+ Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi, On Mon, Oct 26, 2015 at 05:26:42PM -0700, Christoph Hellwig wrote: > On Sun, Oct 25, 2015 at 03:27:13PM +0100, Oleg Nesterov wrote: > > It is not safe to use the task_struct returned by kthread_run(threadfn) > > if threadfn() can exit before the "owner" does kthread_stop(), nothing > > protects this task_struct. > >=20 > > So __nbd_ioctl() looks buggy; a killed nbd_thread_send() can exit, free > > its task_struct, and then kthread_stop() can use the freed/reused memor= y. > >=20 > > Add the new trivial helper, kthread_get_run(). Hopefully it will have m= ore > > users, this patch changes __nbd_ioctl() as an example. >=20 > This looks horrible. I think the real problem is that nbd is totally > abusing signals for kthreads and that needs to go away. To avoid this kthread_get_run() we can change the NBD code as well to guarantee that the thread does not exit until kthread_stop() was called. I think that is independent of using signals. Currently NBD uses signals for the timeout handling to get the threads out of the TCP operations. Do you have an idea how to solve this differently? Best Regards, Markus --=20 Pengutronix e.K. | | Industrial Linux Solutions | http://www.pengutronix.de/ | Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | --jho1yZJdad60DJr+ Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJWLyHWAAoJEEpcgKtcEGQQiZcP/j0TPIIb+tNrVhRIqI1ZqfqF i1nTqiBkm2LB71JYC12qjISufsOs1sYmr9z3wOCbemqGp1xfmG4mM133UWwUkBUv qaj+35Xm4vDB3wiSq/O8Qd+7YR6B+rkHDdM8BUc7pWiv8Pg3LnHg4BgaitX0vqSy shM6yhItpPkv7MxFusw8i+5QoNbW2M7GGaZU4StURqVc3mI/o8mKIrwimnYEWUI8 Ct76jP06UWLAKHs0WwpRCucWTLP6T3Q9Wkv0UMGWbNOAPuwzUuch80mF+6VgUeIs BTTV0cCtojtwHRhX/eWYG4KiIBxRWpCIxwLBU88ALdq4HiLfIhAkRzy5PUnY2eyi mYR0WciKZQnWEfWeXxsLrRb6w7fJH4idLy/Nv0R4bU26Y8zUGP5ZHeOcKIgJpXmo RXW9M71cGeAkQFNARiEGEHZTlD/2J8hm8C2D7pKY3vvR4irGCMUzc32SmFC6spsj nUbD52/API2j0RI29Wi/uo6Py7wh+cYrkjWSPK32bBGH4CNw3nHuF/yCjnRrk4VC hnZ0zOBmNA+e/Gce3y9I027YqHvEV1I+nbJy01/+5VOnvvCRVmRt3s2I2IVO5+KX QHNWyd7HvFY5s9I4MmWYwh0rPLPFGvTWayWZiPocwXLqtdiHKHkBwbCPzx0Cogbu zhzW29NKCie7PsQDfG74 =v8RG -----END PGP SIGNATURE----- --jho1yZJdad60DJr+--