[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 07 Jul 2009 14:07:35 +0800
From: Li Zefan <lizf@...fujitsu.com>
To: Ingo Molnar <mingo@...e.hu>
CC: Lai Jiangshan <laijs@...fujitsu.com>,
Steven Rostedt <rostedt@...dmis.org>,
Frederic Weisbecker <fweisbec@...il.com>,
LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 2/2] trace_workqueue: add refcnt to struct cpu_workqueue_stats
> The stat entries can be freed when the stat file is being read.
> The worse is, the ptr can be freed immediately after it's returned
> from workqueue_stat_start/next().
>
> Add a refcnt to struct cpu_workqueue_stats to avoid use-after-free.
>
> Signed-off-by: Lai Jiangshan <laijs@...fujitsu.com>
> Signed-off-by: Li Zefan <lizf@...fujitsu.com>
> ---
...
> @@ -175,11 +184,14 @@ static void *workqueue_stat_next(void *prev, int idx)
> return NULL;
> } while (!(ret = workqueue_stat_start_cpu(cpu)));
> return ret;
> + } else {
> + ret = list_entry(prev_cws->list.next,
> + struct cpu_workqueue_stats, list);
I just realized accessing prev_cws->list.next can be invalid!
We can fix it by using list_del_init() to delete cws->list in
probe_workqueue_destruction(), but then if the race happened,
the next time stat_next() is called, NULL will be returned.
I guess this is Ok, since the race is rare.
(I never like the design of trace_stat..Fortunately we'll
probably switch to perfcounter for this kind of statistics
reporting)
> + kref_get(&ret->kref);
> }
> spin_unlock_irqrestore(&workqueue_cpu_stat(cpu)->lock, flags);
>
> - return list_entry(prev_cws->list.next, struct cpu_workqueue_stats,
> - list);
> + return ret;
> }
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists