Re: [PATCH 1/1] tracing: Simplify trace_array_get()

[Oleg Nesterov <oleg@redhat.com>]

On 07/19, Oleg Nesterov wrote:
>
> On 07/19, Steven Rostedt wrote:
> >
> > On Fri, 2013-07-19 at 17:51 +0200, Oleg Nesterov wrote:
> > >  	mutex_lock(&trace_types_lock);
> > > -	list_for_each_entry(tr, &ftrace_trace_arrays, list) {
> > > -		if (tr == this_tr) {
> > > -			tr->ref++;
> > > -			ret = 0;
> > > -			break;
> > > -		}
> > > +	if (!list_empty(&this_tr->list)) {
> >
> > Because this_tr can be freed outside the lock. Accessing this_tr->list
> > can cause a crash.
>
> Aaah, indeed.
>
> Thanks Steven!

Yes. But unless I missed something again this logic doesn't look exactly
correct. Because it seems that trace_array_get() can succeed when it
shoudn't.

trace_array_get() can race with instance_delete() + new_instance_create(),
and _create()->kzalloc() can return the same memory which was freed by
_delete().

No?

Oleg.