lkml.org 
[lkml]   [2011]   [Nov]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    SubjectRe: [BUG] 3.2-rc2: BUG kmalloc-8: Redzone overwritten
    From
    Date
    Le lundi 21 novembre 2011 à 11:15 +0100, Eric Dumazet a écrit :

    >
    > Hmm, trinity tries to crash decnet ;)
    >
    > Maybe we should remove this decnet stuff for good instead of tracking
    > all bugs just for the record. Is there anybody still using decnet ?
    >
    > For example dn_start_slow_timer() starts a timer without holding a
    > reference on struct sock, this is highly suspect.
    >
    > [PATCH] decnet: proper socket refcounting
    >
    > Better use sk_reset_timer() / sk_stop_timer() helpers to make sure we
    > dont access already freed/reused memory later.
    >
    > Reported-by: Sasha Levin <levinsasha928@gmail.com>
    > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>

    Hmm, I forgot to remove the sock_hold(sk) call from dn_slow_timer(),
    here is V2 :

    [PATCH] decnet: proper socket refcounting

    Better use sk_reset_timer() / sk_stop_timer() helpers to make sure we
    dont access already freed/reused memory later.

    Reported-by: Sasha Levin <levinsasha928@gmail.com>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    ---
    V2: remove sock_hold(sk) call from dn_slow_timer()

    net/decnet/dn_timer.c | 17 +++++------------
    1 file changed, 5 insertions(+), 12 deletions(-)

    diff --git a/net/decnet/dn_timer.c b/net/decnet/dn_timer.c
    index 67f691b..d9c150c 100644
    --- a/net/decnet/dn_timer.c
    +++ b/net/decnet/dn_timer.c
    @@ -36,16 +36,13 @@ static void dn_slow_timer(unsigned long arg);

    void dn_start_slow_timer(struct sock *sk)
    {
    - sk->sk_timer.expires = jiffies + SLOW_INTERVAL;
    - sk->sk_timer.function = dn_slow_timer;
    - sk->sk_timer.data = (unsigned long)sk;
    -
    - add_timer(&sk->sk_timer);
    + setup_timer(&sk->sk_timer, dn_slow_timer, (unsigned long)sk);
    + sk_reset_timer(sk, &sk->sk_timer, jiffies + SLOW_INTERVAL);
    }

    void dn_stop_slow_timer(struct sock *sk)
    {
    - del_timer(&sk->sk_timer);
    + sk_stop_timer(sk, &sk->sk_timer);
    }

    static void dn_slow_timer(unsigned long arg)
    @@ -53,12 +50,10 @@ static void dn_slow_timer(unsigned long arg)
    struct sock *sk = (struct sock *)arg;
    struct dn_scp *scp = DN_SK(sk);

    - sock_hold(sk);
    bh_lock_sock(sk);

    if (sock_owned_by_user(sk)) {
    - sk->sk_timer.expires = jiffies + HZ / 10;
    - add_timer(&sk->sk_timer);
    + sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ / 10);
    goto out;
    }

    @@ -100,9 +95,7 @@ static void dn_slow_timer(unsigned long arg)
    scp->keepalive_fxn(sk);
    }

    - sk->sk_timer.expires = jiffies + SLOW_INTERVAL;
    -
    - add_timer(&sk->sk_timer);
    + sk_reset_timer(sk, &sk->sk_timer, jiffies + SLOW_INTERVAL);
    out:
    bh_unlock_sock(sk);
    sock_put(sk);

    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2011-11-21 11:25    [W:5.673 / U:0.124 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site