diff options
author | Roger Pau Monne <roger.pau@citrix.com> | 2013-07-31 17:00:42 +0200 |
---|---|---|
committer | Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 2013-08-09 10:58:11 -0400 |
commit | 5f338d9001094a56cf87bd8a280b4e7ff953bb59 (patch) | |
tree | daef4ba1e3c1ecfa3e6dc8f87a21197911f78fc2 /drivers/xen/grant-table.c | |
parent | e2683957fb268c6b29316fd9e7191e13239a30a5 (diff) | |
download | linux-stable-5f338d9001094a56cf87bd8a280b4e7ff953bb59.tar.gz linux-stable-5f338d9001094a56cf87bd8a280b4e7ff953bb59.tar.bz2 linux-stable-5f338d9001094a56cf87bd8a280b4e7ff953bb59.zip |
xen-gnt: prevent adding duplicate gnt callbacks
With the current implementation, the callback in the tail of the list
can be added twice, because the check done in
gnttab_request_free_callback is bogus, callback->next can be NULL if
it is the last callback in the list. If we add the same callback twice
we end up with an infinite loop, were callback == callback->next.
Replace this check with a proper one that iterates over the list to
see if the callback has already been added.
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Matt Wilson <msw@amazon.com>
Reviewed-by: David Vrabel <david.vrabel@citrix.com>
CC: stable@vger.kernel.org
Diffstat (limited to 'drivers/xen/grant-table.c')
-rw-r--r-- | drivers/xen/grant-table.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c index 04cdeb8e3719..c4d2298893b1 100644 --- a/drivers/xen/grant-table.c +++ b/drivers/xen/grant-table.c @@ -730,9 +730,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback, void (*fn)(void *), void *arg, u16 count) { unsigned long flags; + struct gnttab_free_callback *cb; + spin_lock_irqsave(&gnttab_list_lock, flags); - if (callback->next) - goto out; + + /* Check if the callback is already on the list */ + cb = gnttab_free_callback_list; + while (cb) { + if (cb == callback) + goto out; + cb = cb->next; + } + callback->fn = fn; callback->arg = arg; callback->count = count; |