Re: [PATCH] ocfs2/cluster: hold a reference on the heartbeat thread

[Andrew Morton]

On Wed, 23 Sep 2026 10:45:10 +0800 Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx> wrote:

> 
> 
> On 9/23/26 9:01 AM, Karl Mehltretter wrote:
> > Since commit 688bc88e2046 ("ocfs2/cluster: keep heartbeat local node
> > stable"), o2hb_thread() leaves its loop and returns when the local node
> > changes, for example after "echo 0 > node/<name>/local". The thread
> > was started with kthread_run() and nothing holds a reference to its
> > task_struct, so the task is freed once it exits, while reg->hr_task
> > still points to it.
> > 
> > Reading the region's pid attribute then reads the freed task, and
> > removing the region calls kthread_stop() on it:
> > 
> >   BUG: KASAN: slab-use-after-free in o2hb_region_pid_show+0xb3/0xc0
> >   refcount_t: addition on 0; use-after-free.
> >   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> >   RIP: 0010:kthread_stop+0xb1/0x390
> > 
> > The thread could already return by itself before, when heartbeat start
> > was aborted or on an unclean stop, but the local node change makes it
> > reachable from userspace at any time.
> > 
> > Create the thread parked, take a reference on it and only then wake it,
> 
> Just a wording nit. kthread_create() doesn't leave the thread parked in
> the kthread_park() sense. __kthread_parkme() only runs after the first
> wake_up_process(), so "parked" here may be a little confused.

I simply did s/parked //.

> The change looks fine to me.
> Reviewed-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx>

Thanks as always.