From: "Toke Høiland-Jørgensen" <toke@redhat•com>
To: Zhu Yanjun <zyjzyj2000@gmail•com>,
Daniel Borkmann <daniel@iogearbox•net>
Cc: "Zhu Yanjun" <yanjun.zhu@intel•com>,
"Björn Töpel" <bjorn.topel@intel•com>,
"Karlsson, Magnus" <magnus.karlsson@intel•com>,
netdev <netdev@vger•kernel.org>,
jonathan.lemon@gmail•com
Subject: Re: [PATCH v2 1/1] xdp: avoid calling kfree twice
Date: Wed, 09 Dec 2020 11:44:11 +0100 [thread overview]
Message-ID: <87a6unp8ck.fsf@toke.dk> (raw)
In-Reply-To: <CAD=hENc8CmxdPeWbQ=4GFdtQCoCqUc87xS5sq+VePZEGC2-Z6g@mail.gmail.com>
Zhu Yanjun <zyjzyj2000@gmail•com> writes:
> On Wed, Dec 9, 2020 at 1:12 AM Daniel Borkmann <daniel@iogearbox•net> wrote:
>>
>> On 12/9/20 6:03 AM, Zhu Yanjun wrote:
>> > In the function xdp_umem_pin_pages, if npgs != umem->npgs and
>> > npgs >= 0, the function xdp_umem_unpin_pages is called. In this
>> > function, kfree is called to handle umem->pgs, and then in the
>> > function xdp_umem_pin_pages, kfree is called again to handle
>> > umem->pgs. Eventually, umem->pgs is freed twice.
>> >
>> > Acked-by: Björn Töpel <bjorn.topel@intel•com>
>> > Signed-off-by: Zhu Yanjun <yanjun.zhu@intel•com>
>>
>> Please also fix up the commit log according to Bjorn's prior feedback [0].
>> If it's just a cleanup, it should state so, the commit message right now
>> makes it sound like an actual double free bug.
>
> The umem->pgs is actually freed twice. Since umem->pgs is set to NULL
> after the first kfree,
> the second kfree would not trigger call trace.
> IMO, the commit log is very clear about this.
Yes, it is very clear; and also wrong. As someone already pointed out,
passing a NULL pointer to kfree() doesn't actually lead to a double
free:
https://elixir.bootlin.com/linux/latest/source/mm/slub.c#L4106
-Toke
next prev parent reply other threads:[~2020-12-09 10:45 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-09 5:03 [PATCH v2 1/1] xdp: avoid calling kfree twice Zhu Yanjun
2020-12-08 17:12 ` Daniel Borkmann
2020-12-09 4:30 ` Zhu Yanjun
2020-12-09 10:44 ` Toke Høiland-Jørgensen [this message]
2020-12-10 4:34 ` Zhu Yanjun
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87a6unp8ck.fsf@toke.dk \
--to=toke@redhat$(echo .)com \
--cc=bjorn.topel@intel$(echo .)com \
--cc=daniel@iogearbox$(echo .)net \
--cc=jonathan.lemon@gmail$(echo .)com \
--cc=magnus.karlsson@intel$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=yanjun.zhu@intel$(echo .)com \
--cc=zyjzyj2000@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox