[Drbd-dev] [PATCH] Fixed possible use after free in drbd_thread_setup

[Lars Ellenberg]

On Thu, Dec 21, 2017 at 06:53:30PM +0100, johannes at johannesthoma.com wrote:
> drbd_thread might already be freed when complete returns,

The lifetime of our "struct drbd_tread" thingies, which are embeded in
our struct drbd_resource and struct drbd_connection,
is different from the "running" time of the threads.

So no, this won't happen.

> hence we shouldn't access the drbd_thread object (thi)
> after calling complete().
> 
> I am not 100% sure if this creates any further races,

Moving that complete out of the spinlock would introduce
potential races between drbd_thread_setup, drbd_thread_start,
and _drbd_thread_stop, yes.

	Lars