netdev - Re: [PATCH 2/2] ipv4 igmp: use del_timer_sync instead of del_timer in ip_mc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 27 Sep 2013 16:28:01 -0700
From:	Salam Noureddine <noureddine@...stanetworks.com>
To:	Alexey Kuznetsov <kuznet@....inr.ac.ru>
Cc:	Stephen Hemminger <stephen@...workplumber.org>,
	"David S. Miller" <davem@...emloft.net>,
	James Morris <jmorris@...ei.org>,
	Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
	Patrick McHardy <kaber@...sh.net>, netdev@...r.kernel.org
Subject: Re: [PATCH 2/2] ipv4 igmp: use del_timer_sync instead of del_timer in ip_mc_down

Thanks for the explanation. Currenlty, __in_dev_put is both used in
timer handler function and in ip_mc_down where del_timer is invoked. I
guess we need to change the timer handler so it uses in_dev_put to do
proper cleanup in cases where it runs past the call to ip_mc_down and
has the last reference.

On Fri, Sep 27, 2013 at 4:15 PM, Alexey Kuznetsov <kuznet@....inr.ac.ru> wrote:
> On Fri, Sep 27, 2013 at 04:04:00PM -0700, Salam Noureddine wrote:
>>                               I don't quite understand the reason
>> for having __in_dev_put decrement the refcnt without destroying the
>> in_device in case it reaches 0. If the timer handler assumes it cannot
>> be the last one to hold a reference then that would mean it doesn't
>> need the reference in the first place.
>
> I would like to explain this, because this can result in a big mistake.
>
> Timer takes reference, when it _can_ be the last sometimes.
>
> When we do del_timer() and know for sure that someone holds refcnt, we can just
> decrese it. In this cae it is obvious: we sit in context whcih deals with in_dev,
> so that reference from timer acannot be the last: caller of the function holds refcnt.
>
> But in another places timer _expires_ and that last reference is dropped by in_dev_put().
>
> Alexey
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html