* Re: [PATCH net-next 1/2] net:dsa: fix dsa_dst_del_ds()
[not found] <1481129585-9084-1-git-send-email-volodymyr.bendiuga@westermo.se>
@ 2017-01-04 2:45 ` Andrew Lunn
0 siblings, 0 replies; only message in thread
From: Andrew Lunn @ 2017-01-04 2:45 UTC (permalink / raw)
To: Volodymyr Bendiuga
Cc: vivien.didelot, f.fainelli, davem, netdev, volodymyr.bendiuga
On Wed, Dec 07, 2016 at 05:53:05PM +0100, Volodymyr Bendiuga wrote:
> When dsa_dst_del_ds() is called, do not free the whole list,
> instead, only decrement refcount for the switch tree. The list
> will be deleted in dsa_put_dst() if refcount is 0. Nothing
> really needs to be freed for dsa switch, therefore dsa_free_ds()
> is empty. kref_put() will print warning if dsa_free_ds() is not
> passed as a parameter to it.
This does not look correct. I would expect there to be some symmetry.
The dst gets allocated in _dsa_register_switch(), so it should be
freed somewhere in or under _dsa_unregister_switch(). As you say, it
can be freed from dsa_free_dst(), but that is not called from
_dsa_unregister_switch().
dsa_dst_add_ds() and dsa_dst_del_ds() currently look symmetric. Add
increments the ref count for the tree, del decrements it. When it
reaches zero, the tree is freed.
dsa_dst_del_ds() is called from _dsa_unregister_switch(), which gives
us the symmetry with _dsa_register_switch().
What problem are you actually seeing? A double free? A use after free?
Thanks
Andrew
^ permalink raw reply [flat|nested] only message in thread