From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-we0-f177.google.com (mail-we0-f177.google.com [74.125.82.177]) by dpdk.org (Postfix) with ESMTP id 21B9D11C5 for ; Mon, 23 Mar 2015 15:51:59 +0100 (CET) Received: by wetk59 with SMTP id k59so139949960wet.3 for ; Mon, 23 Mar 2015 07:51:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mirantis.com; s=google; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=e7XhEX+kll8N1/Z2fIZcwEoNBww9mQ7I/xsaY7y8S3s=; b=XUMSBUBIpTJ8BLrWS3dP2Ii1HQMqzKC6fWk4XJdIgvl4Rh2teK+CUolABu1UkBjUyJ uXWbfZtpzxMfjPlqtN1HyGEUTEyK3OFdfz15gDkCHCzUUdT+vvOi/feSeflgcSnXTvhl Rfn6GtMHNHO79siUCOaP0ipyCQV48L3COVxpo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=e7XhEX+kll8N1/Z2fIZcwEoNBww9mQ7I/xsaY7y8S3s=; b=JH26yd2qFhNRykQVomNarmj7JtmAClwa0ozpwnIX7HkcfrgGVr+zRY89PLjJinK4C0 EJfglaACwSYCZPc8GAw+3yQl50SYVor73iGvYoKDgQR1P0RkvKIf1UZFkvW9Gj2ZtonM Zl7riirUrSWhYD6FikA7U0JKBWAZ4CLNgx222iZ+W2F1bQeckJcamdlzJ+8Wb+boaOcz IKoWTL02wSenGjn1TgLDEpDPenlhQK0B1kj8viTwv/g+/+yYhyxsfI7oE8E3ZarH07xO NXJldSuyS0n044j2kYWunq+RP8LssctfM3kg4+1l8vldrIFk9wl4x9XrFz+DL5gkN4Fq 4mLw== X-Gm-Message-State: ALoCoQmIVNaoMhrI+vXX55HtjWxsl3Ng02AsiOBd10fwkQgc5HDW/bzimKcTJAMKVlZ/Vuk+frIa MIME-Version: 1.0 X-Received: by 10.180.89.148 with SMTP id bo20mr19642314wib.91.1427122318980; Mon, 23 Mar 2015 07:51:58 -0700 (PDT) Received: by 10.194.76.7 with HTTP; Mon, 23 Mar 2015 07:51:58 -0700 (PDT) In-Reply-To: References: <1427115225-14489-1-git-send-email-pboldin@mirantis.com> Date: Mon, 23 Mar 2015 16:51:58 +0200 Message-ID: From: Pavel Boldin To: "Xie, Huawei" Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.15 Cc: "dev@dpdk.org" Subject: Re: [dpdk-dev] [PATCH] vhost: Fix `struct file' leakage in `eventfd_link' X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Mar 2015 14:51:59 -0000 On Mon, Mar 23, 2015 at 4:41 PM, Xie, Huawei wrote: > On 3/23/2015 10:37 PM, Pavel Boldin wrote: > > > On Mon, Mar 23, 2015 at 4:21 PM, Xie, Huawei huawei.xie@intel.com>> wrote: > On 3/23/2015 8:54 PM, Pavel Boldin wrote: > > Due to increased `struct file's reference counter subsequent call > > to `filp_close' does not free the `struct file'. Prepend `fput' call > > to decrease the reference counter. > > > > Signed-off-by: Pavel Boldin pboldin@mirantis.com>> > > --- > > lib/librte_vhost/eventfd_link/eventfd_link.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/lib/librte_vhost/eventfd_link/eventfd_link.c > b/lib/librte_vhost/eventfd_link/eventfd_link.c > > index 7755dd6..62c45c8 100644 > > --- a/lib/librte_vhost/eventfd_link/eventfd_link.c > > +++ b/lib/librte_vhost/eventfd_link/eventfd_link.c > > @@ -117,6 +117,7 @@ eventfd_link_ioctl(struct file *f, unsigned int > ioctl, unsigned long arg) > > * Release the existing eventfd in the source process > > */ > > spin_lock(&files->file_lock); > > + fput(file); > Could we just call atomic_long_dec here? > > We can but I don't like breaking encapsulation (which is broken anyway by > the code). So, there is a special method and we should use it in my opinion. > it is increased by atomic_long_inc_not_zero so why don't we use the > symmetric function? > The code with `atomic_long_inc_not_zero' call is a copy-paste of the `fget' function. If we want to make it clear we should make a separate function and name it so: `fget_from_files'. Second thing is: another thread of the same processor can call the `sys_close' on the `fd' and this will dereference counter so `fput' will correctly free the `struct file'. Using `atomic_long_dec' will leak a `struct file' and print a KERN_ERR message by `filp_close'. So, the common thing is to use appropriate functions and don't reinvent the wheel. Pavel > > > Pavel > > > filp_close(file, files); > > fdt = files_fdtable(files); > > fdt->fd[eventfd_copy.source_fd] = NULL; > > > >