netdev
[Top] [All Lists]

Re: [1/1] connector/CBUS: new messaging subsystem. Revision number next.

To: dtor_core@xxxxxxxxxxxxx
Subject: Re: [1/1] connector/CBUS: new messaging subsystem. Revision number next.
From: Evgeniy Polyakov <johnpol@xxxxxxxxxxx>
Date: Tue, 26 Apr 2005 20:24:37 +0400
Cc: dmitry.torokhov@xxxxxxxxx, netdev@xxxxxxxxxxx, Greg KH <greg@xxxxxxxxx>, Jamal Hadi Salim <hadi@xxxxxxxxxx>, Kay Sievers <kay.sievers@xxxxxxxx>, Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>, James Morris <jmorris@xxxxxxxxxx>, Guillaume Thouvenin <guillaume.thouvenin@xxxxxxxx>, linux-kernel@xxxxxxxxxxxxxxx, Andrew Morton <akpm@xxxxxxxx>, Thomas Graf <tgraf@xxxxxxx>, Jay Lan <jlan@xxxxxxxxxxxx>
In-reply-to: <d120d5000504260857cb5f99e@xxxxxxxxxxxxxx>
Organization: MIPT
References: <20050411125932.GA19538@xxxxxxxxxxxxxxxxxxxxxxxx> <d120d5000504260857cb5f99e@xxxxxxxxxxxxxx>
Reply-to: johnpol@xxxxxxxxxxx
Sender: netdev-bounce@xxxxxxxxxxx
On Tue, 26 Apr 2005 10:57:55 -0500
Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx> wrote:

> Hi Evgeniy,
> 
> On 4/11/05, Evgeniy Polyakov <johnpol@xxxxxxxxxxx> wrote:
> > /*****************************************/
> > Kernel Connector.
> > /*****************************************/
> ...
> > +static int cn_call_callback(struct cn_msg *msg, void (*destruct_data) 
> > (void *), void *data)
> > +{
> > +       struct cn_callback_entry *__cbq;
> > +       struct cn_dev *dev = &cdev;
> > +       int found = 0;
> > +
> > +       spin_lock_bh(&dev->cbdev->queue_lock);
> > +       list_for_each_entry(__cbq, &dev->cbdev->queue_list, callback_entry) 
> > {
> > +               if (cn_cb_equal(&__cbq->cb->id, &msg->id)) {
> > +                       __cbq->cb->priv = msg;
> > +
> > +                       __cbq->ddata = data;
> > +                       __cbq->destruct_data = destruct_data;
> > +
> > +                       queue_work(dev->cbdev->cn_queue, &__cbq->work);
> 
> It looks like there is a problem with the code. As far as I can see
> there is only one cn_callback_entry associated with each callback. So,
> if someone sends netlink messages with the same id at a high enough
> rate (so cbdev's work queue does not get a chance to get scheduled and
> process pending requests) ddata and the destructor will be overwritten
> which can lead to memory leaks and non-delivery of some messages.
> 
> Am I missing something?

Connector needs to check return value here - zero means 
that work was already queued and we must free shared skb.

There may not be the same work with different data.

> -- 
> Dmitry


        Evgeniy Polyakov

Only failure makes us experts. -- Theo de Raadt

<Prev in Thread] Current Thread [Next in Thread>