From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753355AbdKISKZ (ORCPT ); Thu, 9 Nov 2017 13:10:25 -0500 Received: from vps0.lunn.ch ([185.16.172.187]:50635 "EHLO vps0.lunn.ch" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752659AbdKISKY (ORCPT ); Thu, 9 Nov 2017 13:10:24 -0500 Date: Thu, 9 Nov 2017 19:10:15 +0100 From: Andrew Lunn To: Vivien Didelot Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, kernel@savoirfairelinux.com, "David S. Miller" , Florian Fainelli , Stephen Rothwell , lkp@01.org Subject: Re: [PATCH net-next] net: dsa: remove tree refcount Message-ID: <20171109181015.GH13277@lunn.ch> References: <20171109173652.25258-1-vivien.didelot@savoirfairelinux.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171109173652.25258-1-vivien.didelot@savoirfairelinux.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Nov 09, 2017 at 12:36:52PM -0500, Vivien Didelot wrote: > Setting the refcount to 0 when allocating a tree to match the number of > switch devices it holds may cause an 'increment on 0; use-after-free'. > > Tracking the number of devices in a tree with a kref is not really > appropriate anyway so removes it completely in favor of a basic counter. Hi Vivien How are you protecting this basic counter? switches can come and go at random, modules are loaded and unloaded, probing can happen in parallel, probes can fail with EPROBE_DEFFER causing a switch to unregister itself while others are registering themselves, etc. The point of using a kref is that it is a well known kernel method of safely handling this situation. When the last member of the tree goes away, we safely and atomically remove the tree. It worked well for a few years, until you refactored it. Maybe the correct solution is to revert your change? Andrew