From: Andrew Morton <akpm@digeo.com>
To: Zwane Mwaikambo <zwane@linuxpower.ca>
Cc: linux-kernel@vger.kernel.org, gibbs@scsiguy.com
Subject: Re: aic7(censored) use after free in 2.5.66
Date: Mon, 31 Mar 2003 23:52:05 -0800 [thread overview]
Message-ID: <20030331235205.3d4d8f9f.akpm@digeo.com> (raw)
In-Reply-To: <Pine.LNX.4.50.0304010236270.8773-100000@montezuma.mastecende.com>
Zwane Mwaikambo <zwane@linuxpower.ca> wrote:
>
> On Mon, 31 Mar 2003, Andrew Morton wrote:
>
> > The corruption was at offset 52 decimal into struct ahc_linux_device.
> > Without knowing your config it is hard for me to work out what you have at
> > that offset. Rebuild your kernel with -g and do:
> >
> > (gdb) p/d &(((struct ahc_linux_device *)0)->maxtags)
> >
> > until you find which member is at offset 52.
> >
> > Something incremented that field by one after it was freed.
>
> (gdb) p/d &(((struct ahc_linux_device *)0)->timer.lock)
> $4 = 52
>
> That would be a lock free it appears.
OK, so that's a spin_unlock(&timer->lock) in the timer code itself. Your
patch will fix that up.
We just need to be sure that the del_timer_sync() is not called while holding
any locks which would prevent the timer handler from completing.
next prev parent reply other threads:[~2003-04-01 7:40 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-04-01 6:48 Zwane Mwaikambo
2003-04-01 7:00 ` Zwane Mwaikambo
2003-04-01 7:22 ` Andrew Morton
2003-04-01 7:40 ` Zwane Mwaikambo
2003-04-01 7:52 ` Andrew Morton [this message]
2003-04-01 7:55 ` Zwane Mwaikambo
2003-04-01 8:35 ` Zwane Mwaikambo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030331235205.3d4d8f9f.akpm@digeo.com \
--to=akpm@digeo.com \
--cc=gibbs@scsiguy.com \
--cc=linux-kernel@vger.kernel.org \
--cc=zwane@linuxpower.ca \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®