linux-kernel - [PATCH] md: fix hang in stop_sync_thread by setting THREAD_WAKEUP in md_wakeup_thread

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260110221244.14304-1-jiashengjiangcool@gmail.com>
Date: Sat, 10 Jan 2026 22:12:44 +0000
From: Jiasheng Jiang <jiashengjiangcool@...il.com>
To: Song Liu <song@...nel.org>,
	Yu Kuai <yukuai@...as.com>
Cc: linux-raid@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Jiasheng Jiang <jiashengjiangcool@...il.com>
Subject: [PATCH] md: fix hang in stop_sync_thread by setting THREAD_WAKEUP in md_wakeup_thread_directly

Analysis of md.c shows that the md_thread() loop relies on the
THREAD_WAKEUP bit being set to progress beyond wait_event(). However,
md_wakeup_thread_directly() currently only calls wake_up_process()
without setting this bit.

As a result, a thread woken by md_wakeup_thread_directly() will find the
wait condition remains False and immediately return to sleep without
executing its run() handler. In the case of stop_sync_thread(), this
causes the sync thread to ignore the interruption request, leading to
a permanent hang.

Fix this by ensuring the THREAD_WAKEUP bit is set before waking the
process in md_wakeup_thread_directly().

Signed-off-by: Jiasheng Jiang <jiashengjiangcool@...il.com>
---
 drivers/md/md.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 6d73f6e196a9..8709e9fd7f39 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8512,8 +8512,10 @@ static void md_wakeup_thread_directly(struct md_thread __rcu **thread)

 	rcu_read_lock();
 	t = rcu_dereference(*thread);
-	if (t)
+	if (t) {
+		set_bit(THREAD_WAKEUP, &t->flags);
 		wake_up_process(t->tsk);
+	}
 	rcu_read_unlock();
 }

-- 
2.25.1