linux-kernel - Query:Regarding percpu_counter debug object destroy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 13 Apr 2018 13:02:00 +0530
From:   "Kohli, Gaurav" <gkohli@...eaurora.org>
To:     tj@...nel.org, nborisov@...e.com, akpm@...ux-foundation.org,
        linux-kernel@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, linux-arm-msm@...r.kernel.org
Subject: Query:Regarding percpu_counter debug object destroy

Hi ,

I have checked below code and it seems we are calling debug_object_free twice, ideally we should deactivate and later we
have to destroy.

1st call -> percpu_counter_destroy->debug_percpu_counter_deactivate -> debug_object_free
2nd call ->
debug_object_free



static bool percpu_counter_fixup_free(void *addr, enum debug_obj_state state)
{
         struct percpu_counter *fbc = addr;

         switch (state) {
         case ODEBUG_STATE_ACTIVE:
                 percpu_counter_destroy(fbc);  -> first call
                 debug_object_free(fbc, &percpu_counter_debug_descr); 2nd call
                 return true;
         default:
                 return false;
         }
}


We are seeing one issue, where one list contain garbage data in obj_hash, just before element of that is percpu_counter but
still not sure as it is very difficult to reproduce.

Can some one please review above code or can we remove one instance of debug_object_free from above code.

Regards
Gaurav

-- 
Qualcomm India Private Limited, on behalf of Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project.