mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 03:10:12 +00:00
292a089d78
Due to several bugs caused by timers being re-armed after they are
shutdown and just before they are freed, a new state of timers was added
called "shutdown". After a timer is set to this state, then it can no
longer be re-armed.
The following script was run to find all the trivial locations where
del_timer() or del_timer_sync() is called in the same function that the
object holding the timer is freed. It also ignores any locations where
the timer->function is modified between the del_timer*() and the free(),
as that is not considered a "trivial" case.
This was created by using a coccinelle script and the following
commands:
$ cat timer.cocci
@@
expression ptr, slab;
identifier timer, rfield;
@@
(
- del_timer(&ptr->timer);
+ timer_shutdown(&ptr->timer);
|
- del_timer_sync(&ptr->timer);
+ timer_shutdown_sync(&ptr->timer);
)
... when strict
when != ptr->timer
(
kfree_rcu(ptr, rfield);
|
kmem_cache_free(slab, ptr);
|
kfree(ptr);
)
$ spatch timer.cocci . > /tmp/t.patch
$ patch -p1 < /tmp/t.patch
Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: Pavel Machek <pavel@ucw.cz> [ LED ]
Acked-by: Kalle Valo <kvalo@kernel.org> [ wireless ]
Acked-by: Paolo Abeni <pabeni@redhat.com> [ networking ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||
|---|---|---|
| .. | ||
| 3com | ||
| 8390 | ||
| actions | ||
| adaptec | ||
| adi | ||
| aeroflex | ||
| agere | ||
| alacritech | ||
| allwinner | ||
| alteon | ||
| altera | ||
| amazon | ||
| amd | ||
| apm | ||
| apple | ||
| aquantia | ||
| arc | ||
| asix | ||
| atheros | ||
| broadcom | ||
| brocade | ||
| cadence | ||
| calxeda | ||
| cavium | ||
| chelsio | ||
| cirrus | ||
| cisco | ||
| cortina | ||
| davicom | ||
| dec | ||
| dlink | ||
| emulex | ||
| engleder | ||
| ezchip | ||
| faraday | ||
| freescale | ||
| fujitsu | ||
| fungible | ||
| hisilicon | ||
| huawei | ||
| i825xx | ||
| ibm | ||
| intel | ||
| litex | ||
| marvell | ||
| mediatek | ||
| mellanox | ||
| micrel | ||
| microchip | ||
| microsoft | ||
| moxa | ||
| mscc | ||
| myricom | ||
| natsemi | ||
| neterion | ||
| netronome | ||
| ni | ||
| nvidia | ||
| nxp | ||
| oki-semi | ||
| packetengines | ||
| pasemi | ||
| pensando | ||
| qlogic | ||
| qualcomm | ||
| rdc | ||
| realtek | ||
| renesas | ||
| rocker | ||
| samsung | ||
| seeq | ||
| sfc | ||
| sgi | ||
| silan | ||
| sis | ||
| smsc | ||
| socionext | ||
| stmicro | ||
| sun | ||
| sunplus | ||
| synopsys | ||
| tehuti | ||
| ti | ||
| toshiba | ||
| tundra | ||
| vertexcom | ||
| via | ||
| wangxun | ||
| wiznet | ||
| xilinx | ||
| xircom | ||
| xscale | ||
| dnet.c | ||
| dnet.h | ||
| ec_bhf.c | ||
| ethoc.c | ||
| jme.c | ||
| jme.h | ||
| Kconfig | ||
| korina.c | ||
| lantiq_etop.c | ||
| lantiq_xrx200.c | ||
| Makefile | ||