From: Ding Tianhong <dthxman@gmail.com>
To: Ding Tianhong <dingtianhong@huawei.com>,
Eric Dumazet <eric.dumazet@gmail.com>,
David Miller <davem@davemloft.net>,
yoshfuji@linux-ipv6.org, joe@perches.com, vfalico@redhat.com,
netdev@vger.kernel.org
Subject: Re: [PATCH net] net: neighbour: add neighbour dead check for neigh_timer_handler()
Date: Wed, 18 Dec 2013 23:12:51 +0800 [thread overview]
Message-ID: <52B1BB73.20005@gmail.com> (raw)
In-Reply-To: <20131218142715.GC3505@order.stressinduktion.org>
于 2013/12/18 22:27, Hannes Frederic Sowa 写道:
> On Wed, Dec 18, 2013 at 07:57:40PM +0800, Ding Tianhong wrote:
>> yes, I cannot repruduce the bug again.
>
> Hmm, it actually seems hard to hit even if the race happens. Even if slab
> poisoning is active it would only hit if ->solicit would be called again,
> because that is the only pointer dereference directly used in the old memory.
>
> neigh_alloc allocates memory with kzalloc, so it would null out that memory,
> so the race would not only have to race with kfree, the memory needs to be
> reallocated in the mean time.
>
> I would suggest adding some poisoning manually in neigh_release before kfree
> and check for this in all periodic called functions. Maybe we can see it
> again?
>
> Greetings,
>
> Hannes
>
Great, thanks for your help, I think make the neigh_release not kfree neighbour until
the timer is over is a clear way to fix this, maybe you could another idea, glad to
hear your opinion.
Regards
Ding
>
next prev parent reply other threads:[~2013-12-18 15:24 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-03 13:48 [PATCH net] net: neighbour: add neighbour dead check for neigh_timer_handler() Ding Tianhong
2013-12-03 15:03 ` Hannes Frederic Sowa
2013-12-04 1:36 ` Ding Tianhong
2013-12-03 16:28 ` Eric Dumazet
2013-12-04 1:59 ` Ding Tianhong
2013-12-03 16:37 ` David Miller
2013-12-04 2:37 ` Gao feng
2013-12-04 4:04 ` Ding Tianhong
2013-12-04 4:21 ` David Miller
2013-12-04 6:19 ` Ding Tianhong
2013-12-04 6:27 ` Eric Dumazet
2013-12-04 9:16 ` Ding Tianhong
2013-12-04 10:10 ` Gao feng
2013-12-04 15:24 ` Eric Dumazet
2013-12-05 0:32 ` Gao feng
2013-12-05 3:17 ` Ding Tianhong
2013-12-18 6:37 ` Ding Tianhong
2013-12-18 7:51 ` Hannes Frederic Sowa
2013-12-18 8:19 ` Ding Tianhong
2013-12-18 8:41 ` Hannes Frederic Sowa
2013-12-18 8:57 ` Ding Tianhong
2013-12-18 9:28 ` Hannes Frederic Sowa
2013-12-18 10:02 ` Ding Tianhong
2013-12-18 10:21 ` Hannes Frederic Sowa
2013-12-18 11:57 ` Ding Tianhong
2013-12-18 14:27 ` Hannes Frederic Sowa
2013-12-18 15:12 ` Ding Tianhong [this message]
2013-12-18 15:46 ` Hannes Frederic Sowa
2013-12-19 3:32 ` Ding Tianhong
2013-12-04 6:36 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52B1BB73.20005@gmail.com \
--to=dthxman@gmail.com \
--cc=davem@davemloft.net \
--cc=dingtianhong@huawei.com \
--cc=eric.dumazet@gmail.com \
--cc=joe@perches.com \
--cc=netdev@vger.kernel.org \
--cc=vfalico@redhat.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).