mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 09:19:51 +00:00
![]() Due to several bugs caused by timers being re-armed after they are shutdown and just before they are freed, a new state of timers was added called "shutdown". After a timer is set to this state, then it can no longer be re-armed. The following script was run to find all the trivial locations where del_timer() or del_timer_sync() is called in the same function that the object holding the timer is freed. It also ignores any locations where the timer->function is modified between the del_timer*() and the free(), as that is not considered a "trivial" case. This was created by using a coccinelle script and the following commands: $ cat timer.cocci @@ expression ptr, slab; identifier timer, rfield; @@ ( - del_timer(&ptr->timer); + timer_shutdown(&ptr->timer); | - del_timer_sync(&ptr->timer); + timer_shutdown_sync(&ptr->timer); ) ... when strict when != ptr->timer ( kfree_rcu(ptr, rfield); | kmem_cache_free(slab, ptr); | kfree(ptr); ) $ spatch timer.cocci . > /tmp/t.patch $ patch -p1 < /tmp/t.patch Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/ Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Acked-by: Pavel Machek <pavel@ucw.cz> [ LED ] Acked-by: Kalle Valo <kvalo@kernel.org> [ wireless ] Acked-by: Paolo Abeni <pabeni@redhat.com> [ networking ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
---|---|---|
.. | ||
bcm63xx_pcmcia.c | ||
bcm63xx_pcmcia.h | ||
cardbus.c | ||
cirrus.h | ||
cistpl.c | ||
cs.c | ||
cs_internal.h | ||
db1xxx_ss.c | ||
ds.c | ||
electra_cf.c | ||
i82092.c | ||
i82092aa.h | ||
i82365.c | ||
i82365.h | ||
Kconfig | ||
Makefile | ||
max1600.c | ||
max1600.h | ||
o2micro.h | ||
omap_cf.c | ||
pcmcia_cis.c | ||
pcmcia_resource.c | ||
pd6729.c | ||
pd6729.h | ||
pxa2xx_base.c | ||
pxa2xx_base.h | ||
pxa2xx_mainstone.c | ||
pxa2xx_sharpsl.c | ||
ricoh.h | ||
rsrc_iodyn.c | ||
rsrc_mgr.c | ||
rsrc_nonstatic.c | ||
sa11xx_base.c | ||
sa11xx_base.h | ||
sa1100_generic.c | ||
sa1100_generic.h | ||
sa1100_h3600.c | ||
sa1100_simpad.c | ||
sa1111_badge4.c | ||
sa1111_generic.c | ||
sa1111_generic.h | ||
sa1111_jornada720.c | ||
sa1111_lubbock.c | ||
sa1111_neponset.c | ||
soc_common.c | ||
soc_common.h | ||
socket_sysfs.c | ||
tcic.c | ||
tcic.h | ||
ti113x.h | ||
topic.h | ||
vg468.h | ||
xxs1500_ss.c | ||
yenta_socket.c | ||
yenta_socket.h |