Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1703000

Re: [PATCH] hysdn: fix to a race condition in put_log_buffer

From Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Newsgroups linux.kernel
Subject Re: [PATCH] hysdn: fix to a race condition in put_log_buffer
Date 2017-08-03 14:10 +0200
Message-ID <uan6W-8co-11@gated-at.bofh.it> (permalink)
References <u85nQ-7rT-5@gated-at.bofh.it> <uamNA-7Pj-9@gated-at.bofh.it>
Organization Cogent Embedded

Show all headers | View raw


Hello!

On 08/03/2017 02:33 PM, Anton Volkov wrote:

> The synchronization type that was used earlier to guard the loop that
> deletes unused log buffers may lead to a situation that prevents any
> thread from going through the loop.
> 
> The patch deletes previously used synchronization mechanism and moves
> the loop under the spin_lock so the similar cases won't be feasible in
> the future.
> 
> Found by by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Anton Volkov <avolkov@ispras.ru>
> ---
>   drivers/isdn/hysdn/hysdn_proclog.c | 27 ++++++++++++---------------
>   1 file changed, 12 insertions(+), 15 deletions(-)
> 
> diff --git a/drivers/isdn/hysdn/hysdn_proclog.c b/drivers/isdn/hysdn/hysdn_proclog.c
> index 7b5fd8f..b152c6c 100644
> --- a/drivers/isdn/hysdn/hysdn_proclog.c
> +++ b/drivers/isdn/hysdn/hysdn_proclog.c
[...]
>   	else
>   		pd->log_tail->next = ib;	/* follows existing messages */
>   	pd->log_tail = ib;	/* new tail */
> -	i = pd->del_lock++;	/* get lock state */
> -	spin_unlock_irqrestore(&card->hysdn_lock, flags);
>   
>   	/* delete old entrys */
> -	if (!i)
> -		while (pd->log_head->next) {
> -			if ((pd->log_head->usage_cnt <= 0) &&
> -			    (pd->log_head->next->usage_cnt <= 0)) {
> -				ib = pd->log_head;
> -				pd->log_head = pd->log_head->next;
> -				kfree(ib);
> -			} else
> -				break;
> -		}		/* pd->log_head->next */
> -	pd->del_lock--;		/* release lock level */
> +	while (pd->log_head->next) {
> +		if ((pd->log_head->usage_cnt <= 0) &&
> +		    (pd->log_head->next->usage_cnt <= 0)) {
> +			ib = pd->log_head;
> +			pd->log_head = pd->log_head->next;
> +			kfree(ib);
> +		} else
> +			break;
> +	}		/* pd->log_head->next */

    Need {} in the *else* branch as *if* had them.

[...]

MBR, Sergei

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH] hysdn: fix to a race condition in put_log_buffer Anton Volkov <avolkov@ispras.ru> - 2017-08-03 13:50 +0200
  Re: [PATCH] hysdn: fix to a race condition in put_log_buffer Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> - 2017-08-03 14:10 +0200
    [PATCH v2] hysdn: fix to a race condition in put_log_buffer Anton Volkov <avolkov@ispras.ru> - 2017-08-07 15:00 +0200
      Re: [PATCH v2] hysdn: fix to a race condition in put_log_buffer David Miller <davem@davemloft.net> - 2017-08-07 20:30 +0200

csiph-web