On 24/10/17 13:47, Kees Cook wrote:
On Tue, Oct 24, 2017 at 2:40 AM, Bryan O'Donoghue <pure.logic@xxxxxxxxxxxxxxxxx> wrote:On 24/10/17 10:35, Bryan O'Donoghue wrote:On 24/10/17 09:25, Kees Cook wrote:In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Cc: "Bryan O'Donoghue" <pure.logic@xxxxxxxxxxxxxxxxx> Cc: Johan Hovold <johan@xxxxxxxxxx> Cc: Alex Elder <elder@xxxxxxxxxx> Cc: greybus-dev@xxxxxxxxxxxxxxxx Cc: devel@xxxxxxxxxxxxxxxxxxxx Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> --- drivers/staging/greybus/loopback.c | 14 ++++---------- drivers/staging/greybus/operation.c | 7 +++---- 2 files changed, 7 insertions(+), 14 deletions(-) diff --git a/drivers/staging/greybus/loopback.c b/drivers/staging/greybus/loopback.c index 08e255884206..045aaf81113a 100644 --- a/drivers/staging/greybus/loopback.c +++ b/drivers/staging/greybus/loopback.c @@ -572,16 +572,11 @@ static void gb_loopback_async_operation_work(struct work_struct *work) gb_loopback_async_operation_put(op_async); } -static void gb_loopback_async_operation_timeout(unsigned long data) +static void gb_loopback_async_operation_timeout(struct timer_list *t) { - struct gb_loopback_async_operation *op_async; - u16 id = data; + struct gb_loopback_async_operation *op_async = + from_timer(op_async, t, timer); - op_async = gb_loopback_operation_find(id); - if (!op_async) { - pr_err("operation %d not found - time out ?\n", id); - return; - }Hi Kees, you need to add gb_loopback_async_operation_get(op_async); when dropping the gb_loopback_operation_find() call here.Actually: spin_lock_irqsave(&gb_dev.lock, flags); gb_loopback_async_operation_get(op_async); spin_unlock_irqrestore(&gb_dev.lock, flags);Shouldn't the get/put follow the lifetime of the timer running instead? It shouldnt' be possible to free the op_async while the timer is still pending/running. -Kees
The timeout timer runs for an operation that never completed but on the regular "everything is good" path you end up doing del_timer_sync(&op_async->timer); so the timer doesn't run.
_______________________________________________ greybus-dev mailing list greybus-dev@xxxxxxxxxxxxxxxx https://lists.linaro.org/mailman/listinfo/greybus-dev
|