> Hi Lee, > > > > > > I'm struggling to apply this for test: > > > > > > > > > > > > "error: corrupt patch at line 6" > > > > > > > > > > Check with the attached patch. > > > > > > > > With the patch applied: > > > > > > > > [ 188.825418][ T75] refcount_t: addition on 0; use-after-free. > > > > [ 188.825418][ T75] refcount_t: addition on 0; use-after-free. > > > > > > Looks like the changes just make the issue more visible since we are > > > trying to add a refcount when it is already 0 so this proves the > > > design is not quite right since it is removing the object from the > > > list only when destroying it while we probably need to do it before. > > > > > > How about we use kref_get_unless_zero as it appears it was introduced > > > exactly for such cases (patch attached.) > > > > Looks like I missed a few places like l2cap_global_chan_by_psm so here > > is another version. > > Any feedback regarding these changes? Not yet. I'll have time to test this next week. Things really stacked up this week, apologies. -- Lee Jones [李琼斯] Principal Technical Lead - Developer Services Linaro.org │ Open source software for Arm SoCs Follow Linaro: Facebook | Twitter | Blog
