On 24/10/17 13:47, Kees Cook wrote:
> On Tue, Oct 24, 2017 at 2:40 AM, Bryan O'Donoghue
> <[email protected]> wrote:
>> On 24/10/17 10:35, Bryan O'Donoghue wrote:
>>>
>>> On 24/10/17 09:25, Kees Cook wrote:
>>>>
>>>> In preparation for unconditionally passing the struct timer_list pointer
>>>> to
>>>> all timer callbacks, switch to using the new timer_setup() and
>>>> from_timer()
>>>> to pass the timer pointer explicitly.
>>>>
>>>> Cc: Greg Kroah-Hartman <[email protected]>
>>>> Cc: "Bryan O'Donoghue" <[email protected]>
>>>> Cc: Johan Hovold <[email protected]>
>>>> Cc: Alex Elder <[email protected]>
>>>> Cc: [email protected]
>>>> Cc: [email protected]
>>>> Signed-off-by: Kees Cook <[email protected]>
>>>> ---
>>>> drivers/staging/greybus/loopback.c | 14 ++++----------
>>>> drivers/staging/greybus/operation.c | 7 +++----
>>>> 2 files changed, 7 insertions(+), 14 deletions(-)
>>>>
>>>> diff --git a/drivers/staging/greybus/loopback.c
>>>> b/drivers/staging/greybus/loopback.c
>>>> index 08e255884206..045aaf81113a 100644
>>>> --- a/drivers/staging/greybus/loopback.c
>>>> +++ b/drivers/staging/greybus/loopback.c
>>>> @@ -572,16 +572,11 @@ static void gb_loopback_async_operation_work(struct
>>>> work_struct *work)
>>>> gb_loopback_async_operation_put(op_async);
>>>> }
>>>> -static void gb_loopback_async_operation_timeout(unsigned long data)
>>>> +static void gb_loopback_async_operation_timeout(struct timer_list *t)
>>>> {
>>>> - struct gb_loopback_async_operation *op_async;
>>>> - u16 id = data;
>>>> + struct gb_loopback_async_operation *op_async =
>>>> + from_timer(op_async, t, timer);
>>>> - op_async = gb_loopback_operation_find(id);
>>>> - if (!op_async) {
>>>> - pr_err("operation %d not found - time out ?\n", id);
>>>> - return;
>>>> - }
>>>
>>>
>>> Hi Kees, you need to add
>>>
>>> gb_loopback_async_operation_get(op_async); when dropping the
>>> gb_loopback_operation_find() call here.
>>
>>
>> Actually:
>>
>> spin_lock_irqsave(&gb_dev.lock, flags);
>> gb_loopback_async_operation_get(op_async);
>> spin_unlock_irqrestore(&gb_dev.lock, flags);
>
> Shouldn't the get/put follow the lifetime of the timer running
> instead? It shouldnt' be possible to free the op_async while the timer
> is still pending/running.
>
> -Kees
>
The timeout timer runs for an operation that never completed but on the
regular "everything is good" path you end up doing
del_timer_sync(&op_async->timer); so the timer doesn't run.
From 1582143208968459542@xxx Tue Oct 24 12:49:03 +0000 2017
X-GM-THRID: 1582126742408023281
X-Gmail-Labels: Inbox,Category Forums