Subject: Re: [PATCH net] net: neighbour: add neighbour dead check for neigh_timer_handler()

From: Ding Tianhong <[email-masked]>
Date: Wed, 18 Dec 2013 23:12:51 +0800

于 2013/12/18 22:27, Hannes Frederic Sowa 写道:
> On Wed, Dec 18, 2013 at 07:57:40PM +0800, Ding Tianhong wrote:
>> yes, I cannot repruduce the bug again.
> 
> Hmm, it actually seems hard to hit even if the race happens. Even if slab
> poisoning is active it would only hit if ->solicit would be called again,
> because that is the only pointer dereference directly used in the old memory.
> 
> neigh_alloc allocates memory with kzalloc, so it would null out that memory,
> so the race would not only have to race with kfree, the memory needs to be
> reallocated in the mean time.
> 
> I would suggest adding some poisoning manually in neigh_release before kfree
> and check for this in all periodic called functions. Maybe we can see it
> again?
> 
> Greetings,
> 
>   Hannes
> 

Great, thanks for your help, I think make the neigh_release not kfree neighbour until
the timer is over is a clear way to  fix this, maybe you could another idea, glad to
hear your opinion.

Regards
Ding