Messages in this thread | | | Date | Fri, 19 Jul 2013 19:20:53 +0200 | From | Oleg Nesterov <> | Subject | Re: [PATCH 1/1] tracing: Simplify trace_array_get() |
| |
On 07/19, Oleg Nesterov wrote: > > On 07/19, Steven Rostedt wrote: > > > > On Fri, 2013-07-19 at 17:51 +0200, Oleg Nesterov wrote: > > > mutex_lock(&trace_types_lock); > > > - list_for_each_entry(tr, &ftrace_trace_arrays, list) { > > > - if (tr == this_tr) { > > > - tr->ref++; > > > - ret = 0; > > > - break; > > > - } > > > + if (!list_empty(&this_tr->list)) { > > > > Because this_tr can be freed outside the lock. Accessing this_tr->list > > can cause a crash. > > Aaah, indeed. > > Thanks Steven!
Yes. But unless I missed something again this logic doesn't look exactly correct. Because it seems that trace_array_get() can succeed when it shoudn't.
trace_array_get() can race with instance_delete() + new_instance_create(), and _create()->kzalloc() can return the same memory which was freed by _delete().
No?
Oleg.
| |