Re: [tipc-discussion] [PATCH net-next v3 1/1] tipc: fix crash during node removal

Ack-by: Ying Xue -Original Message- From: Jon Maloy [mailto:jon.ma...@ericsson.com] Sent: 2016年2月20日 9:17 To: tipc-discussion@lists.sourceforge.net; parthasarathy.bhuvara...@ericsson.com; Xue, Ying; richard.a...@ericsson.com; jon.ma...@ericsson.com;

Re: [tipc-discussion] [PATCH net-next v3 1/1] tipc: fix crash during node removal

HI Jon, Thanks for your clear explanation. Yes, I misunderstood the scenario. You are right and its solution is much simpler and safer than before. Please go ahead. Thanks, Ying From: Jon Maloy [mailto:jon.ma...@ericsson.com] Sent: 2016年2月23日 21:17 To: Xue, Ying; jason Cc: Jon Maloy; Richard

Re: [tipc-discussion] [PATCH net-next v3 1/1] tipc: fix crash during node removal

On Feb 23, 2016 6:20 PM, "Xue, Ying" wrote: > > Even if node timeout function restarts the node timer with mod_timer(), I don’t see any problem here. If you concern the usage about dealing with node timer and its refcount, please look at another similar example which can

Re: [tipc-discussion] [PATCH net-next v3 1/1] tipc: fix crash during node removal

Hi Jon, I think the scenario described below is not true. This is because del_timer() doesn't return 1 while node_timeout() is being called. Please take a look at __run_timers() defined in kernel/time/timer.c. When a timer is expired, __run_timers() will call the timeout function attached to

[tipc-discussion] [PATCH net-next v3 1/1] tipc: fix crash during node removal

When the TIPC module is unloaded, we have identified a race condition that allows a node reference counter to go to zero and the node instance being freed before the node timer is finished with accessing it. This leads to occasional crashes, especially in multi-namespace environments. The