ub: ubmgr: drop the ping tjetty reference and unlink it atomically · Pull Request !1142 · OpenCloudOS/OpenCloudOS-Kernel

## Problem

`ping_tjetty_put()` decides whether the reference it is dropping is the last one
with `kref_read()` under `ctx->tjetty_lock`, and then calls `kref_put()` after
dropping that lock:

```c
	spin_lock_irqsave(&ctx->tjetty_lock, flag);
	if (kref_read(&entry->kref) == 1) {
		hlist_del(&entry->node);
		last = true;
	}
	spin_unlock_irqrestore(&ctx->tjetty_lock, flag);

kref_put(&entry->kref, __ping_tjetty_free_entry);
	if (last)
		kfree(entry);
```

Two references can be dropped concurrently on the ping workqueue (an unbound
workqueue), for example when the completions of two pings to the same peer are
processed at the same time. Both readers then observe a count above one, so
neither of them unlinks the entry, while the two `kref_put()` calls still drive
the count to zero, which runs the release callback and unimports (frees) the
tjetty. The entry stays in the hash with a dangling tjetty, so the next
`__ping_tjetty_find()` from `ping_tjetty_find_or_create()` dereferences freed
memory, and the entry itself is never freed.

## Fix

Make the reference drop and the unlink atomic with
`refcount_dec_and_lock()`: the count update and the hash removal then happen
together, and an entry whose last reference is gone can no longer be found. The
jetty is unimported after the lock is dropped, because `ubcore_unimport_jetty()`
may sleep. The field therefore becomes a `refcount_t` and the `kref` release
callback turns into a plain helper.

## Verification

- `scripts/checkpatch.pl --no-signoff --strict`: 0 errors, 0 warnings.
- arm64 build (`CONFIG_UB=y` + `CONFIG_UB_URMA=y`, target `drivers/ub/urma/ubcore/`, Bootlin aarch64 gcc 15.3.0, `W=1`): baseline and patched trees both build with exit 0, all 24 objects force-recompiled in both cases, and both show the same 5 pre-existing `-Wmissing-prototypes` warnings in `ubcore_connect_adapter.c`; no new diagnostics.
- Not run: runtime test. No UB hardware is available in the development environment; the race needs two concurrent reference drops on the ping workqueue.

类型	指派人员	状态
审查	zoucao Huang Cun Jianping Liu	已完成 (0/0人)
测试	Jianping Liu	已完成 (0/0人)

GVPOpenCloudOS / OpenCloudOS-Kernel

搜索帮助

GVP OpenCloudOS / OpenCloudOS-Kernel