kthreads: fix kthread_create() vs kthread_stop() race

PATCH In review Oleg Nesterov 2 participants 2 messages Aug 24, 2009 – Aug 25, 2009

Share & tools

Oleg Nesterov

author

2009-08-24 10:52 UTC #0 lore raw

PATCH 1/1 kthreads: fix kthread_create() vs kthread_stop() race

The bug should be "accidently" fixed by recent changes in 2.6.31, all kernels <= 2.6.30 need the fix. The problem was never noticed before, it was found because it causes mysterious failures with GFS mount/umount.

Credits to Robert Peterson. He blaimed kthread.c from the very beginning. But, despite my promise, I forgot to inspect the old implementation until he did a lot of testing and reminded me. This led to huge delay in fixing this bug.

kthread_stop() does put_task_struct(k) before it clears kthread_stop_info.k. This means another kthread_create() can re-use this task_struct, but the new kthread can still see kthread_should_stop() == T and exit even without calling threadfn().

Reported-by Robert Peterson <[email protected]>

Tested-by Robert Peterson <[email protected]>

Signed-off-by Oleg Nesterov <[email protected]>

kernel/kthread.c +1 -1

@@ -216,12 +216,12 @@ int kthread_stop(struct task_struct *k)
 	/* Now set kthread_should_stop() to true, and wake it up. */
 	kthread_stop_info.k = k;
 	wake_up_process(k);
-	put_task_struct(k);
 
 	/* Once it dies, reset stop ptr, gather result and we're done. */
 	wait_for_completion(&kthread_stop_info.done);
 	kthread_stop_info.k = NULL;
 	ret = kthread_stop_info.err;
+	put_task_struct(k);
 	mutex_unlock(&kthread_stop_lock);
 
 	trace_sched_kthread_stop_ret(ret);

Rusty Russell

Acked-by on v1 1/1

2009-08-25 14:36 UTC #1 lore raw

Quoted 9 lines · Oleg Nesterov

The bug should be "accidently" fixed by recent changes in 2.6.31, all kernels <= 2.6.30 need the fix. The problem was never noticed before, it was found because it causes mysterious failures with GFS mount/umount.
Credits to Robert Peterson. He blaimed kthread.c from the very beginning. But, despite my promise, I forgot to inspect the old implementation until he did a lot of testing and reminded me. This led to huge delay in fixing this bug.

Quoted 8 lines

kthread_stop() does put_task_struct(k) before it clears kthread_stop_info.k. This means another kthread_create() can re-use this task_struct, but the new kthread can still see kthread_should_stop() == T and exit even without calling threadfn().
Reported-by Robert Peterson <[email protected]>
Tested-by Robert Peterson <[email protected]>
Signed-off-by Oleg Nesterov <[email protected]>

Acked-by Rusty Russell <[email protected]>

Thanks, good catch!
Rusty.