On 24/10/17 13:47, Kees Cook wrote:
On Tue, Oct 24, 2017 at 2:40 AM, Bryan O'Donoghue
<pure.logic@xxxxxxxxxxxxxxxxx> wrote:
On 24/10/17 10:35, Bryan O'Donoghue wrote:
On 24/10/17 09:25, Kees Cook wrote:
In preparation for unconditionally passing the struct timer_list pointer
to
all timer callbacks, switch to using the new timer_setup() and
from_timer()
to pass the timer pointer explicitly.
Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Cc: "Bryan O'Donoghue" <pure.logic@xxxxxxxxxxxxxxxxx>
Cc: Johan Hovold <johan@xxxxxxxxxx>
Cc: Alex Elder <elder@xxxxxxxxxx>
Cc: greybus-dev@xxxxxxxxxxxxxxxx
Cc: devel@xxxxxxxxxxxxxxxxxxxx
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
---
drivers/staging/greybus/loopback.c | 14 ++++----------
drivers/staging/greybus/operation.c | 7 +++----
2 files changed, 7 insertions(+), 14 deletions(-)
diff --git a/drivers/staging/greybus/loopback.c
b/drivers/staging/greybus/loopback.c
index 08e255884206..045aaf81113a 100644
--- a/drivers/staging/greybus/loopback.c
+++ b/drivers/staging/greybus/loopback.c
@@ -572,16 +572,11 @@ static void gb_loopback_async_operation_work(struct
work_struct *work)
gb_loopback_async_operation_put(op_async);
}
-static void gb_loopback_async_operation_timeout(unsigned long data)
+static void gb_loopback_async_operation_timeout(struct timer_list *t)
{
- struct gb_loopback_async_operation *op_async;
- u16 id = data;
+ struct gb_loopback_async_operation *op_async =
+ from_timer(op_async, t, timer);
- op_async = gb_loopback_operation_find(id);
- if (!op_async) {
- pr_err("operation %d not found - time out ?\n", id);
- return;
- }
Hi Kees, you need to add
gb_loopback_async_operation_get(op_async); when dropping the
gb_loopback_operation_find() call here.
Actually:
spin_lock_irqsave(&gb_dev.lock, flags);
gb_loopback_async_operation_get(op_async);
spin_unlock_irqrestore(&gb_dev.lock, flags);
Shouldn't the get/put follow the lifetime of the timer running
instead? It shouldnt' be possible to free the op_async while the timer
is still pending/running.
-Kees
The timeout timer runs for an operation that never completed but on the
regular "everything is good" path you end up doing
del_timer_sync(&op_async->timer); so the timer doesn't run.
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
