Suspecting double kfree in function: reset_receive_filter , file : af_linx.c

2020-08-03T10:00:08.890000Z

Hi *,
i was browsing the linx code and i found some suspeted code as below.
In reset_receive_filter function taking lock and reseting the filter , but storing the filter outside the lock.
since "filter = linx_sk(sk)->filter;" is outside the lock , so there can be multiple threades which can store the memory and free it multiple times.

Note : Assuming reset_receive_filter can be accessed by multiple threads for same sock*, that's why it is protected with lock.

static void reset_receive_filter(struct sock sk)
{
LINX_SIGSELECT filter;

linx_trace_enter(LINX_TRACEGROUP_AF_LINX, "%p", sk);

filter = linx_sk(sk)->filter;
if (unlikely(filter != NULL)) {
    spin_lock_bh(&sk->sk_receive_queue.lock);
    linx_sk(sk)->from_filter = LINX_ILLEGAL_SPID;
    linx_sk(sk)->filter = NULL;
    spin_unlock_bh(&sk->sk_receive_queue.lock);
    linx_kfree(filter);
}

}

so i think , it should be somting like below:

static void reset_receive_filter(struct sock sk)
{
LINX_SIGSELECT filter;

linx_trace_enter(LINX_TRACEGROUP_AF_LINX, "%p", sk);

**spin_lock_bh(&sk->sk_receive_queue.lock);**
filter = linx_sk(sk)->filter;
if (unlikely(filter != NULL)) {
    linx_sk(sk)->from_filter = LINX_ILLEGAL_SPID;
    linx_sk(sk)->filter = NULL;
}

spin_unlock_bh(&sk->sk_receive_queue.lock);
if (unlikely(filter != NULL)) {
linx_kfree(filter);
}
}

there are more places code is present in same way... for ex in setup_receive_filter, linx_ioctl_receive etc....

please provide your the feedback.

Thanks in advance,
Rajesh Kumar Vishwakarma

Different sender and receiver threads II

2018-07-13T17:28:19.447000Z

Oh sorry. VxWorks is a whole different thing. I can help with Linux environments but for VxWorks I think you need to contact Enea.

Different sender and receiver threads II

2018-07-13T15:17:11.360000Z

I tried but I am unable to use mkethcon or any other command on vxworks shell.

Different sender and receiver threads II

2018-07-13T14:26:38.548000Z

you need to setup a connection between the two machines. See section 4.5 of the user guide
http://linx.sourceforge.net/linxdoc/doc/usersguide/UsersGuide_LINX_for_Linux.html#inter-node

Different sender and receiver threads II

2018-07-12T12:50:38.902000Z

I am trying to use linx socket between two machines. How can I do that?

Unable to proceed further on my project.
Can someone post a sample client server program on LINX which communicates between client and server in C or C++.

Any help would be highly appreciated.

Thanks
Dev

linx_receive_w_tmo

2017-03-15T21:36:59.518000Z

I am calling this function linx_receive_w_tmo with 30000ms timeout but after 30 seconds timeout, it is not returning. But if i give 5 seconds timeout, it works perfectly. What could be the reason if it is not returning?

I am using LINX communication between threads. Please help me!!

Help with linx_open errno 95

2016-05-19T14:56:33.880000Z

Bin (bbzhang) identified the root cause of this issue. We think that the following update is needed:

This block of code in net/linx/af_linx.c:

    /* linx_publish() must be done first, it sets linx_sk(sk)->addr! */
    err = linx_sock_stats_add(linx_sk(sk));
    if (err != 0) {
            goto out_release;
    }

needs to be updated to:

    /* linx_publish() must be done first, it sets linx_sk(sk)->addr! */
    err = linx_sock_stats_add(linx_sk(sk));
    if (err != 0) {

            /* The following code is the fix for linx_open failure. */

            /* if the return code is ERESTARTSYS, clean up before return */
            if(err == -ERESTARTSYS) {
                linx_unpublish(sk);
                linx_sk(sk)->addr = NULL;
            }

            goto out_release;
    }

Recent posts to Discussion

Suspecting double kfree in function: reset_receive_filter , file : af_linx.c

Different sender and receiver threads II

Different sender and receiver threads II

Different sender and receiver threads II

Different sender and receiver threads II

linx_receive_w_tmo

Help with linx_open errno 95