linux-kernel - Re: [PATCH] md: fix hang in stop_sync_thread by setting THREAD_WAKEUP in md_wakeup_thread

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <dc64a750-1785-482a-964b-d1e590876bc2@fnnas.com>
Date: Mon, 12 Jan 2026 00:12:48 +0800
From: "Yu Kuai" <yukuai@...as.com>
To: "Jiasheng Jiang" <jiashengjiangcool@...il.com>, 
	"Song Liu" <song@...nel.org>, <yukuai@...as.com>
Cc: <linux-raid@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] md: fix hang in stop_sync_thread by setting THREAD_WAKEUP in md_wakeup_thread_directly

Hi,

在 2026/1/11 6:12, Jiasheng Jiang 写道:
> Analysis of md.c shows that the md_thread() loop relies on the
> THREAD_WAKEUP bit being set to progress beyond wait_event(). However,
> md_wakeup_thread_directly() currently only calls wake_up_process()
> without setting this bit.
>
> As a result, a thread woken by md_wakeup_thread_directly() will find the
> wait condition remains False and immediately return to sleep without
> executing its run() handler. In the case of stop_sync_thread(), this
> causes the sync thread to ignore the interruption request, leading to
> a permanent hang.

This doesn't look correct, md_wakeup_thread_directly() is not used in the
case to start a new md_do_sync() as you described. It's used in the case
that md_do_sync() is already running and stuck somewhere and could be
interrupted by setting MD_RECOVERY_INTR.

>
> Fix this by ensuring the THREAD_WAKEUP bit is set before waking the
> process in md_wakeup_thread_directly().
>
> Signed-off-by: Jiasheng Jiang <jiashengjiangcool@...il.com>
> ---
>   drivers/md/md.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 6d73f6e196a9..8709e9fd7f39 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -8512,8 +8512,10 @@ static void md_wakeup_thread_directly(struct md_thread __rcu **thread)
>   
>   	rcu_read_lock();
>   	t = rcu_dereference(*thread);
> -	if (t)
> +	if (t) {
> +		set_bit(THREAD_WAKEUP, &t->flags);
>   		wake_up_process(t->tsk);
> +	}
>   	rcu_read_unlock();
>   }
>   

-- 
Thansk,
Kuai