linux-kernel - Re: [PATCH 2/3] mm/kmemleak.c: Use list_for_each_entry_safe to reconstruct function scan_gray

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 30 May 2013 15:40:28 +0100
From:	Catalin Marinas <catalin.marinas@....com>
To:	majianpeng <majianpeng@...il.com>
Cc:	linux-mm <linux-mm@...ck.org>,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 2/3] mm/kmemleak.c: Use list_for_each_entry_safe to
 reconstruct function scan_gray_list

On Tue, May 14, 2013 at 12:49:44PM +0100, majianpeng wrote:
> Signed-off-by: Jianpeng Ma <majianpeng@...il.com>
> ---
>  mm/kmemleak.c | 8 +-------
>  1 file changed, 1 insertion(+), 7 deletions(-)
> 
> diff --git a/mm/kmemleak.c b/mm/kmemleak.c
> index b1525db..f0ece93 100644
> --- a/mm/kmemleak.c
> +++ b/mm/kmemleak.c
> @@ -1225,22 +1225,16 @@ static void scan_gray_list(void)
>  	 * from inside the loop. The kmemleak objects cannot be freed from
>  	 * outside the loop because their use_count was incremented.
>  	 */
> -	object = list_entry(gray_list.next, typeof(*object), gray_list);
> -	while (&object->gray_list != &gray_list) {
> +	list_for_each_entry_safe(object, tmp, &gray_list, gray_list) {
>  		cond_resched();
>  
>  		/* may add new objects to the list */
>  		if (!scan_should_stop())
>  			scan_object(object);
>  
> -		tmp = list_entry(object->gray_list.next, typeof(*object),
> -				 gray_list);
> -
>  		/* remove the object from the list and release it */
>  		list_del(&object->gray_list);
>  		put_object(object);
> -
> -		object = tmp;
>  	}
>  	WARN_ON(!list_empty(&gray_list));

I tried this patch for a few days and I hit the WARN_ON after the loop.
During scanning, new entries may be added at the end of the loop but we
need to loop until all the entries have been removed. I probably had a
reason why I had the 'while' loop.

The key difference is that list_for_each_entry_safe() gets the next
entry (n or tmp above) before scan_object() and it may hit the end of
the list. However, scan_object() may do a list_add_tail(&gray_list)
hence we need to get the next entry after this function.

Basically list_for_each_entry_safe() is not safe with tail additions.
I'll revert this patch (hasn't reached mainline anyway).

Thanks.

-- 
Catalin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/