lkml.org 
[lkml]   [2005]   [Apr]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [1/1] connector/CBUS: new messaging subsystem. Revision number next.
On Tue, 26 Apr 2005 10:57:55 -0500
Dmitry Torokhov <dmitry.torokhov@gmail.com> wrote:

> Hi Evgeniy,
>
> On 4/11/05, Evgeniy Polyakov <johnpol@2ka.mipt.ru> wrote:
> > /*****************************************/
> > Kernel Connector.
> > /*****************************************/
> ...
> > +static int cn_call_callback(struct cn_msg *msg, void (*destruct_data) (void *), void *data)
> > +{
> > + struct cn_callback_entry *__cbq;
> > + struct cn_dev *dev = &cdev;
> > + int found = 0;
> > +
> > + spin_lock_bh(&dev->cbdev->queue_lock);
> > + list_for_each_entry(__cbq, &dev->cbdev->queue_list, callback_entry) {
> > + if (cn_cb_equal(&__cbq->cb->id, &msg->id)) {
> > + __cbq->cb->priv = msg;
> > +
> > + __cbq->ddata = data;
> > + __cbq->destruct_data = destruct_data;
> > +
> > + queue_work(dev->cbdev->cn_queue, &__cbq->work);
>
> It looks like there is a problem with the code. As far as I can see
> there is only one cn_callback_entry associated with each callback. So,
> if someone sends netlink messages with the same id at a high enough
> rate (so cbdev's work queue does not get a chance to get scheduled and
> process pending requests) ddata and the destructor will be overwritten
> which can lead to memory leaks and non-delivery of some messages.
>
> Am I missing something?

Connector needs to check return value here - zero means
that work was already queued and we must free shared skb.

There may not be the same work with different data.

> --
> Dmitry


Evgeniy Polyakov

Only failure makes us experts. -- Theo de Raadt
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-04-26 18:51    [W:0.263 / U:0.120 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site