Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH] staging: greybus: Convert timers to use timer_setup()
To:     Kees Cook <keescook@chromium.org>
Cc:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Johan Hovold <johan@kernel.org>, Alex Elder <elder@kernel.org>,
        greybus-dev@lists.linaro.org, devel@driverdev.osuosl.org,
        LKML <linux-kernel@vger.kernel.org>
References: <20171024082550.GA142933@beast>
 <3caa07a1-4f46-d879-cfec-586addc006af@nexus-software.ie>
 <42078a19-4922-3efe-8515-99cf6296ceed@nexus-software.ie>
 <CAGXu5jJaReoppUddWDByw78+XPZbGmBf12Cp9tu_gZG-8Qb71Q@mail.gmail.com>
From:   Bryan O'Donoghue <pure.logic@nexus-software.ie>
Message-ID: <20c510b6-345d-06b0-e559-d781a307b7d2@nexus-software.ie>
Date:   Tue, 24 Oct 2017 13:52:50 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.1.1
MIME-Version: 1.0
In-Reply-To: <CAGXu5jJaReoppUddWDByw78+XPZbGmBf12Cp9tu_gZG-8Qb71Q@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 24/10/17 13:47, Kees Cook wrote:
> On Tue, Oct 24, 2017 at 2:40 AM, Bryan O'Donoghue
> <pure.logic@nexus-software.ie> wrote:
>> On 24/10/17 10:35, Bryan O'Donoghue wrote:
>>>
>>> On 24/10/17 09:25, Kees Cook wrote:
>>>>
>>>> In preparation for unconditionally passing the struct timer_list pointer
>>>> to
>>>> all timer callbacks, switch to using the new timer_setup() and
>>>> from_timer()
>>>> to pass the timer pointer explicitly.
>>>>
>>>> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>>>> Cc: "Bryan O'Donoghue" <pure.logic@nexus-software.ie>
>>>> Cc: Johan Hovold <johan@kernel.org>
>>>> Cc: Alex Elder <elder@kernel.org>
>>>> Cc: greybus-dev@lists.linaro.org
>>>> Cc: devel@driverdev.osuosl.org
>>>> Signed-off-by: Kees Cook <keescook@chromium.org>
>>>> ---
>>>>    drivers/staging/greybus/loopback.c  | 14 ++++----------
>>>>    drivers/staging/greybus/operation.c |  7 +++----
>>>>    2 files changed, 7 insertions(+), 14 deletions(-)
>>>>
>>>> diff --git a/drivers/staging/greybus/loopback.c
>>>> b/drivers/staging/greybus/loopback.c
>>>> index 08e255884206..045aaf81113a 100644
>>>> --- a/drivers/staging/greybus/loopback.c
>>>> +++ b/drivers/staging/greybus/loopback.c
>>>> @@ -572,16 +572,11 @@ static void gb_loopback_async_operation_work(struct
>>>> work_struct *work)
>>>>        gb_loopback_async_operation_put(op_async);
>>>>    }
>>>> -static void gb_loopback_async_operation_timeout(unsigned long data)
>>>> +static void gb_loopback_async_operation_timeout(struct timer_list *t)
>>>>    {
>>>> -    struct gb_loopback_async_operation *op_async;
>>>> -    u16 id = data;
>>>> +    struct gb_loopback_async_operation *op_async =
>>>> +        from_timer(op_async, t, timer);
>>>> -    op_async = gb_loopback_operation_find(id);
>>>> -    if (!op_async) {
>>>> -        pr_err("operation %d not found - time out ?\n", id);
>>>> -        return;
>>>> -    }
>>>
>>>
>>> Hi Kees, you need to add
>>>
>>>       gb_loopback_async_operation_get(op_async); when dropping the
>>> gb_loopback_operation_find() call here.
>>
>>
>> Actually:
>>
>>          spin_lock_irqsave(&gb_dev.lock, flags);
>>          gb_loopback_async_operation_get(op_async);
>>          spin_unlock_irqrestore(&gb_dev.lock, flags);
> 
> Shouldn't the get/put follow the lifetime of the timer running
> instead? It shouldnt' be possible to free the op_async while the timer
> is still pending/running.
> 
> -Kees
> 

The timeout timer runs for an operation that never completed but on the 
regular "everything is good" path you end up doing 
del_timer_sync(&op_async->timer); so the timer doesn't run.


From 1582143208968459542@xxx Tue Oct 24 12:49:03 +0000 2017
X-GM-THRID: 1582126742408023281
X-Gmail-Labels: Inbox,Category Forums