Re: J1939 crash after receiving BAM frame and no DT frame

[Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>]

> On Wed, Nov 25, 2015 at 3:59 PM, Marc Kleine-Budde <mkl@pengutronix.de> wrote:
> > On 11/25/2015 02:39 PM, laurent vaudoit wrote:
> >>>> i have found a workaround, working with rtpatch, but not sure if this
> >>>> can be considered as a bug fix or not.
> >>>> in function j1939tp_rxtask, there is a call to j1939session_cancel,
> >>>> who call put_session
> >>>> and at the end of j1939tp_rxtask, we call put_session.
> >>>> if i comment this "second call" to put_session, the problem disappear.
> >>>
> >>> It seems that you added a memory leak because put_session if a ref
> >>> counter. You keep the session installed ... forever, or until a next
> >>> similar session is about to be created.
> >>>
> >>> I'm not sure either that this is the correct way to proceed.
> >>
> >> i'm not sure i understand well.
> >> this seems weird for me to have one get_session and 2 put_session
> >> should'nt we have one get_session and one put_session only? (this is
> >> what i tried)?

When you come to the point where you want to get rid of the session,
you need decrement the refcounter to become zero.
This extra put_session compensates the initial 1 in the refcounter.

I still don't see where it goes wrong. Can you experiment with disabling
individual lines in j1939session_destroy()? Since problems occur only
later, I suspect that the call to skb_free is causing the issue, but I'm
not sure.

Kurt