summaryrefslogtreecommitdiffstats
path: root/drivers/xen
diff options
context:
space:
mode:
authorRoger Pau Monne <roger.pau@citrix.com>2013-07-31 17:00:42 +0200
committerKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>2013-08-09 10:58:11 -0400
commit5f338d9001094a56cf87bd8a280b4e7ff953bb59 (patch)
treedaef4ba1e3c1ecfa3e6dc8f87a21197911f78fc2 /drivers/xen
parente2683957fb268c6b29316fd9e7191e13239a30a5 (diff)
downloadlinux-5f338d9001094a56cf87bd8a280b4e7ff953bb59.tar.bz2
xen-gnt: prevent adding duplicate gnt callbacks
With the current implementation, the callback in the tail of the list can be added twice, because the check done in gnttab_request_free_callback is bogus, callback->next can be NULL if it is the last callback in the list. If we add the same callback twice we end up with an infinite loop, were callback == callback->next. Replace this check with a proper one that iterates over the list to see if the callback has already been added. Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Cc: David Vrabel <david.vrabel@citrix.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Acked-by: Matt Wilson <msw@amazon.com> Reviewed-by: David Vrabel <david.vrabel@citrix.com> CC: stable@vger.kernel.org
Diffstat (limited to 'drivers/xen')
-rw-r--r--drivers/xen/grant-table.c13
1 files changed, 11 insertions, 2 deletions
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 04cdeb8e3719..c4d2298893b1 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -730,9 +730,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback,
void (*fn)(void *), void *arg, u16 count)
{
unsigned long flags;
+ struct gnttab_free_callback *cb;
+
spin_lock_irqsave(&gnttab_list_lock, flags);
- if (callback->next)
- goto out;
+
+ /* Check if the callback is already on the list */
+ cb = gnttab_free_callback_list;
+ while (cb) {
+ if (cb == callback)
+ goto out;
+ cb = cb->next;
+ }
+
callback->fn = fn;
callback->arg = arg;
callback->count = count;