Re: [PATCH] softirq: fix memory corruption when freeing tasklet_struct

From: Mikulas Patocka
Date: Thu Jan 25 2024 - 17:04:55 EST




On Thu, 25 Jan 2024, Linus Torvalds wrote:

> On Thu, 25 Jan 2024 at 10:30, Mikulas Patocka <mpatocka@xxxxxxxxxx> wrote:
> >
> > There's a problem with the tasklet API - there is no reliable way how to
> > free a structure that contains tasklet_struct. The problem is that the
> > function tasklet_action_common calls task_unlock(t) after it called the
> > callback. If the callback does something that frees tasklet_struct,
> > task_unlock(t) would write into free memory.
>
> Ugh.
>
> I see what you're doing, but I have to say, I dislike this patch
> immensely. It feels like a serious misdesign that is then papered over
> with a hack.
>
> I'd much rather see us trying to move away from tasklets entirely in
> cases like this. Just say "you cannot do that".

OK. I will delete tasklets from both dm-crypt and dm-verity - it will
simplify them quite a bit.

BTW. Do you think that we should get rid of request-based device mapper as
well? (that's another thing that looks like code bloat to me)

Mikulas