diff options
| author | David Vrabel <david.vrabel@citrix.com> | 2014-09-02 15:21:30 +0100 |
|---|---|---|
| committer | David Vrabel <david.vrabel@citrix.com> | 2014-09-04 13:14:05 +0100 |
| commit | 5903c6bd1a48d90b99e207ec2a6a7673cbbb732d (patch) | |
| tree | f9e12fe0547957d77ca1c803da954999741794ae /drivers/xen | |
| parent | e9de2e5fd602c4f5ddf212d3837b19ad4f5878ad (diff) | |
| download | linux-stable-5903c6bd1a48d90b99e207ec2a6a7673cbbb732d.tar.gz linux-stable-5903c6bd1a48d90b99e207ec2a6a7673cbbb732d.tar.bz2 linux-stable-5903c6bd1a48d90b99e207ec2a6a7673cbbb732d.zip | |
xen/gntalloc: safely delete grefs in add_grefs() undo path
If a gref could not be added (perhaps because the limit has been
reached or there are no more grant references available), the undo
path may crash because __del_gref() frees the gref while it is being
used for a list iteration.
A comment suggests that using list_for_each_entry() is safe since the
gref isn't removed from the list being iterated over, but it is freed
and thus list_for_each_entry_safe() must be used.
Also, explicitly delete the gref from the local per-file list, even
though this is not strictly necessary.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Diffstat (limited to 'drivers/xen')
| -rw-r--r-- | drivers/xen/gntalloc.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/xen/gntalloc.c b/drivers/xen/gntalloc.c index 8ed2bb4f6f21..e53fe191738c 100644 --- a/drivers/xen/gntalloc.c +++ b/drivers/xen/gntalloc.c @@ -124,7 +124,7 @@ static int add_grefs(struct ioctl_gntalloc_alloc_gref *op, int i, rc, readonly; LIST_HEAD(queue_gref); LIST_HEAD(queue_file); - struct gntalloc_gref *gref; + struct gntalloc_gref *gref, *next; readonly = !(op->flags & GNTALLOC_FLAG_WRITABLE); rc = -ENOMEM; @@ -160,8 +160,8 @@ undo: mutex_lock(&gref_mutex); gref_size -= (op->count - i); - list_for_each_entry(gref, &queue_file, next_file) { - /* __del_gref does not remove from queue_file */ + list_for_each_entry_safe(gref, next, &queue_file, next_file) { + list_del(&gref->next_file); __del_gref(gref); } |