292a089d78
Due to several bugs caused by timers being re-armed after they are
shutdown and just before they are freed, a new state of timers was added
called "shutdown". After a timer is set to this state, then it can no
longer be re-armed.
The following script was run to find all the trivial locations where
del_timer() or del_timer_sync() is called in the same function that the
object holding the timer is freed. It also ignores any locations where
the timer->function is modified between the del_timer*() and the free(),
as that is not considered a "trivial" case.
This was created by using a coccinelle script and the following
commands:
$ cat timer.cocci
@@
expression ptr, slab;
identifier timer, rfield;
@@
(
- del_timer(&ptr->timer);
+ timer_shutdown(&ptr->timer);
|
- del_timer_sync(&ptr->timer);
+ timer_shutdown_sync(&ptr->timer);
)
... when strict
when != ptr->timer
(
kfree_rcu(ptr, rfield);
|
kmem_cache_free(slab, ptr);
|
kfree(ptr);
)
$ spatch timer.cocci . > /tmp/t.patch
$ patch -p1 < /tmp/t.patch
Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: Pavel Machek <pavel@ucw.cz> [ LED ]
Acked-by: Kalle Valo <kvalo@kernel.org> [ wireless ]
Acked-by: Paolo Abeni <pabeni@redhat.com> [ networking ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||
|---|---|---|
| .. | ||
| blink | ||
| flash | ||
| rgb | ||
| simple | ||
| trigger | ||
| Kconfig | ||
| led-class-flash.c | ||
| led-class-multicolor.c | ||
| led-class.c | ||
| led-core.c | ||
| led-triggers.c | ||
| leds-88pm860x.c | ||
| leds-acer-a500.c | ||
| leds-adp5520.c | ||
| leds-an30259a.c | ||
| leds-apu.c | ||
| leds-ariel.c | ||
| leds-asic3.c | ||
| leds-aw2013.c | ||
| leds-bcm6328.c | ||
| leds-bcm6358.c | ||
| leds-bd2802.c | ||
| leds-blinkm.c | ||
| leds-clevo-mail.c | ||
| leds-cobalt-qube.c | ||
| leds-cobalt-raq.c | ||
| leds-cpcap.c | ||
| leds-cr0014114.c | ||
| leds-da903x.c | ||
| leds-da9052.c | ||
| leds-dac124s085.c | ||
| leds-el15203000.c | ||
| leds-gpio-register.c | ||
| leds-gpio.c | ||
| leds-hp6xx.c | ||
| leds-ip30.c | ||
| leds-ipaq-micro.c | ||
| leds-is31fl32xx.c | ||
| leds-is31fl319x.c | ||
| leds-lm355x.c | ||
| leds-lm3530.c | ||
| leds-lm3532.c | ||
| leds-lm3533.c | ||
| leds-lm3642.c | ||
| leds-lm3692x.c | ||
| leds-lm3697.c | ||
| leds-lm36274.c | ||
| leds-locomo.c | ||
| leds-lp50xx.c | ||
| leds-lp55xx-common.c | ||
| leds-lp55xx-common.h | ||
| leds-lp3944.c | ||
| leds-lp3952.c | ||
| leds-lp5521.c | ||
| leds-lp5523.c | ||
| leds-lp5562.c | ||
| leds-lp8501.c | ||
| leds-lp8788.c | ||
| leds-lp8860.c | ||
| leds-lt3593.c | ||
| leds-max8997.c | ||
| leds-max77650.c | ||
| leds-mc13783.c | ||
| leds-menf21bmc.c | ||
| leds-mlxcpld.c | ||
| leds-mlxreg.c | ||
| leds-mt6323.c | ||
| leds-net48xx.c | ||
| leds-netxbig.c | ||
| leds-nic78bx.c | ||
| leds-ns2.c | ||
| leds-ot200.c | ||
| leds-pca955x.c | ||
| leds-pca963x.c | ||
| leds-pca9532.c | ||
| leds-pm8058.c | ||
| leds-powernv.c | ||
| leds-pwm.c | ||
| leds-rb532.c | ||
| leds-regulator.c | ||
| leds-s3c24xx.c | ||
| leds-sc27xx-bltc.c | ||
| leds-spi-byte.c | ||
| leds-ss4200.c | ||
| leds-sunfire.c | ||
| leds-syscon.c | ||
| leds-tca6507.c | ||
| leds-ti-lmu-common.c | ||
| leds-tlc591xx.c | ||
| leds-tps6105x.c | ||
| leds-turris-omnia.c | ||
| leds-wm831x-status.c | ||
| leds-wm8350.c | ||
| leds-wrap.c | ||
| leds.h | ||
| Makefile | ||
| TODO | ||
| uleds.c | ||