Commit 2b7d6a8c authored by James Bottomley's avatar James Bottomley Committed by James Bottomley

[SCSI] attribute container final klist fixes

Since the attribute container deletes from a klist while it's walking
it, it is vulnerable to the problem (and fix) here:

http://marc.theaimsgroup.com/?l=linux-scsi&m=112485448830217

The attached fixes this (but won't compile without the above).

It also fixes the logical reversal in the traversal loop which meant
that we were never actually traversing the loop to hit this bug in the
first place.
Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
parent 53c165e0
...@@ -27,6 +27,21 @@ struct internal_container { ...@@ -27,6 +27,21 @@ struct internal_container {
struct class_device classdev; struct class_device classdev;
}; };
static void internal_container_klist_get(struct klist_node *n)
{
struct internal_container *ic =
container_of(n, struct internal_container, node);
class_device_get(&ic->classdev);
}
static void internal_container_klist_put(struct klist_node *n)
{
struct internal_container *ic =
container_of(n, struct internal_container, node);
class_device_put(&ic->classdev);
}
/** /**
* attribute_container_classdev_to_container - given a classdev, return the container * attribute_container_classdev_to_container - given a classdev, return the container
* *
...@@ -57,7 +72,8 @@ int ...@@ -57,7 +72,8 @@ int
attribute_container_register(struct attribute_container *cont) attribute_container_register(struct attribute_container *cont)
{ {
INIT_LIST_HEAD(&cont->node); INIT_LIST_HEAD(&cont->node);
klist_init(&cont->containers); klist_init(&cont->containers,internal_container_klist_get,
internal_container_klist_put);
down(&attribute_container_mutex); down(&attribute_container_mutex);
list_add_tail(&cont->node, &attribute_container_list); list_add_tail(&cont->node, &attribute_container_list);
...@@ -163,8 +179,8 @@ attribute_container_add_device(struct device *dev, ...@@ -163,8 +179,8 @@ attribute_container_add_device(struct device *dev,
#define klist_for_each_entry(pos, head, member, iter) \ #define klist_for_each_entry(pos, head, member, iter) \
for (klist_iter_init(head, iter); (pos = ({ \ for (klist_iter_init(head, iter); (pos = ({ \
struct klist_node *n = klist_next(iter); \ struct klist_node *n = klist_next(iter); \
n ? ({ klist_iter_exit(iter) ; NULL; }) : \ n ? container_of(n, typeof(*pos), member) : \
container_of(n, typeof(*pos), member);\ ({ klist_iter_exit(iter) ; NULL; }); \
}) ) != NULL; ) }) ) != NULL; )
...@@ -206,7 +222,7 @@ attribute_container_remove_device(struct device *dev, ...@@ -206,7 +222,7 @@ attribute_container_remove_device(struct device *dev,
klist_for_each_entry(ic, &cont->containers, node, &iter) { klist_for_each_entry(ic, &cont->containers, node, &iter) {
if (dev != ic->classdev.dev) if (dev != ic->classdev.dev)
continue; continue;
klist_remove(&ic->node); klist_del(&ic->node);
if (fn) if (fn)
fn(cont, dev, &ic->classdev); fn(cont, dev, &ic->classdev);
else { else {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment