Commit 5f338d90 authored Jul 31, 2013 by Roger Pau Monne Committed by Konrad Rzeszutek Wilk Aug 09, 2013

xen-gnt: prevent adding duplicate gnt callbacks



With the current implementation, the callback in the tail of the list
can be added twice, because the check done in
gnttab_request_free_callback is bogus, callback->next can be NULL if
it is the last callback in the list. If we add the same callback twice
we end up with an infinite loop, were callback == callback->next.

Replace this check with a proper one that iterates over the list to
see if the callback has already been added.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Matt Wilson <msw@amazon.com>
Reviewed-by: David Vrabel <david.vrabel@citrix.com>
CC: stable@vger.kernel.org

parent e2683957

drivers/xen/grant-table.c

+11 −2

Original line number	Original line	Diff line number	Diff line
	@@ -730,9 +730,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback,
	void (fn)(void ), void *arg, u16 count)		void (fn)(void ), void *arg, u16 count)
	{		{
	unsigned long flags;		unsigned long flags;
			struct gnttab_free_callback *cb;

	spin_lock_irqsave(&gnttab_list_lock, flags);		spin_lock_irqsave(&gnttab_list_lock, flags);
	if (callback->next)
			/* Check if the callback is already on the list */
			cb = gnttab_free_callback_list;
			while (cb) {
			if (cb == callback)
	goto out;		goto out;
			cb = cb->next;
			}

	callback->fn = fn;		callback->fn = fn;
	callback->arg = arg;		callback->arg = arg;
	callback->count = count;		callback->count = count;

Admin message