On Tue, Dec 04, 2012 at 03:21:53PM +0100, Roger Pau Monne wrote:
> Implement a safe version of llist_for_each_entry, and use it in
> blkif_free. Previously grants where freed while iterating the list,
> which lead to dereferences when trying to fetch the next item.
Looks like xen-blkfront is the only user of this llist_for_each_entry.
Would it be more prudent to put the macro in the llist.h file?
>
> Reported-by: Dan Carpenter <dan.carpen...@oracle.com>
> Signed-off-by: Roger Pau Monné <roger....@citrix.com>
> Cc: Konrad Rzeszutek Wilk <kon...@kernel.org>
> Cc: xen-de...@lists.xen.org
> ---
> drivers/block/xen-blkfront.c | 10 +++++++++-
> 1 files changed, 9 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
> index 96e9b00..df21b05 100644
> --- a/drivers/block/xen-blkfront.c
> +++ b/drivers/block/xen-blkfront.c
> @@ -143,6 +143,13 @@ static DEFINE_SPINLOCK(minor_lock);
>
> #define DEV_NAME "xvd" /* name in /dev */
>
> +#define llist_for_each_entry_safe(pos, n, node, member) \
> + for ((pos) = llist_entry((node), typeof(*(pos)), member), \
> + (n) = (pos)->member.next; \
> + &(pos)->member != NULL; \
> + (pos) = llist_entry(n, typeof(*(pos)), member), \
> + (n) = (&(pos)->member != NULL) ? (pos)->member.next : NULL)
> +
> static int get_id_from_freelist(struct blkfront_info *info)
> {
> unsigned long free = info->shadow_free;
> @@ -792,6 +799,7 @@ static void blkif_free(struct blkfront_info *info, int
> suspend)
> {
> struct llist_node *all_gnts;
> struct grant *persistent_gnt;
> + struct llist_node *n;
>
> /* Prevent new requests being issued until we fix things up. */
> spin_lock_irq(&info->io_lock);
> @@ -804,7 +812,7 @@ static void blkif_free(struct blkfront_info *info, int
> suspend)
> /* Remove all persistent grants */
> if (info->persistent_gnts_c) {
> all_gnts = llist_del_all(&info->persistent_gnts);
> - llist_for_each_entry(persistent_gnt, all_gnts, node) {
> + llist_for_each_entry_safe(persistent_gnt, n, all_gnts, node) {
> gnttab_end_foreign_access(persistent_gnt->gref, 0, 0UL);
> __free_page(pfn_to_page(persistent_gnt->pfn));
> kfree(persistent_gnt);
> --
> 1.7.7.5 (Apple Git-26)
>
>
> _______________________________________________
> Xen-devel mailing list
> xen-de...@lists.xen.org
> http://lists.xen.org/xen-devel
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
