Received-SPF: pass (google.com: domain of linux-kernel+bounces-39404-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Message-ID: <5e2b5f23-94f0-4bf0-80a6-48380c7dc730@kernel.org>
Date: Fri, 26 Jan 2024 08:15:13 +0900
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] softirq: fix memory corruption when freeing
 tasklet_struct
Content-Language: en-US
To: Mikulas Patocka <mpatocka@redhat.com>,
 Linus Torvalds <torvalds@linux-foundation.org>
Cc: Tejun Heo <tj@kernel.org>, Thomas Gleixner <tglx@linutronix.de>,
 linux-kernel@vger.kernel.org, dm-devel@lists.linux.dev,
 Mike Snitzer <msnitzer@redhat.com>, Ignat Korchagin <ignat@cloudflare.com>,
 Damien Le Moal <damien.lemoal@wdc.com>, Hou Tao <houtao1@huawei.com>,
 Peter Zijlstra <peterz@infradead.org>, Ingo Molnar <mingo@redhat.com>
References: <82b964f0-c2c8-a2c6-5b1f-f3145dc2c8e5@redhat.com>
 <CAHk-=wjDW53w4-YcSmgKC5RruiRLHmJ1sXeYdp_ZgVoBw=5byA@mail.gmail.com>
 <586ca4dd-f191-9ada-1bc3-e5672f17f7c@redhat.com>
From: Damien Le Moal <dlemoal@kernel.org>
Organization: Western Digital Research
In-Reply-To: <586ca4dd-f191-9ada-1bc3-e5672f17f7c@redhat.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

On 1/26/24 07:04, Mikulas Patocka wrote:
> 
> 
> On Thu, 25 Jan 2024, Linus Torvalds wrote:
> 
>> On Thu, 25 Jan 2024 at 10:30, Mikulas Patocka <mpatocka@redhat.com> wrote:
>>>
>>> There's a problem with the tasklet API - there is no reliable way how to
>>> free a structure that contains tasklet_struct. The problem is that the
>>> function tasklet_action_common calls task_unlock(t) after it called the
>>> callback. If the callback does something that frees tasklet_struct,
>>> task_unlock(t) would write into free memory.
>>
>> Ugh.
>>
>> I see what you're doing, but I have to say, I dislike this patch
>> immensely. It feels like a serious misdesign that is then papered over
>> with a hack.
>>
>> I'd much rather see us trying to move away from tasklets entirely in
>> cases like this. Just say "you cannot do that".
> 
> OK. I will delete tasklets from both dm-crypt and dm-verity - it will 
> simplify them quite a bit.
> 
> BTW. Do you think that we should get rid of request-based device mapper as 
> well? (that's another thing that looks like code bloat to me)

That would force removing dm-multipath, which is I think the only DM driver
using requests. But given how widespread the use of dm-multipath is, killing it
would likely make a lot of people unhappy...

-- 
Damien Le Moal
Western Digital Research