Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f84adf49 authored by Konrad Rzeszutek Wilk's avatar Konrad Rzeszutek Wilk
Browse files

xen-blkfront: drop the use of llist_for_each_entry_safe 



Replace llist_for_each_entry_safe with a while loop.

llist_for_each_entry_safe can trigger a bug in GCC 4.1, so it's best
to remove it and use a while loop and do the deletion manually.

Specifically this bug can be triggered by hot-unplugging a disk, either
by doing xm block-detach or by save/restore cycle.

BUG: unable to handle kernel paging request at fffffffffffffff0
IP: [<ffffffffa0047223>] blkif_free+0x63/0x130 [xen_blkfront]
The crash call trace is:
	...
bad_area_nosemaphore+0x13/0x20
do_page_fault+0x25e/0x4b0
page_fault+0x25/0x30
? blkif_free+0x63/0x130 [xen_blkfront]
blkfront_resume+0x46/0xa0 [xen_blkfront]
xenbus_dev_resume+0x6c/0x140
pm_op+0x192/0x1b0
device_resume+0x82/0x1e0
dpm_resume+0xc9/0x1a0
dpm_resume_end+0x15/0x30
do_suspend+0x117/0x1e0

When drilling down to the assembler code, on newer GCC it does
.L29:
        cmpq    $-16, %r12      #, persistent_gnt check
        je      .L30    	#, out of the loop
.L25:
	... code in the loop
        testq   %r13, %r13      # n
        je      .L29    	#, back to the top of the loop
        cmpq    $-16, %r12      #, persistent_gnt check
        movq    16(%r12), %r13  # <variable>.node.next, n
        jne     .L25    	#,	back to the top of the loop
.L30:

While on GCC 4.1, it is:
L78:
	... code in the loop
	testq   %r13, %r13      # n
        je      .L78    #,	back to the top of the loop
        movq    16(%rbx), %r13  # <variable>.node.next, n
        jmp     .L78    #,	back to the top of the loop

Which basically means that the exit loop condition instead of
being:

	&(pos)->member != NULL;

is:
	;

which makes the loop unbound.

Since xen-blkfront is the only user of the llist_for_each_entry_safe
macro remove it from llist.h.

Orabug: 16263164
CC: stable@vger.kernel.org
Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
parent 01c681d4

drivers/block/xen-blkfront.c

+10 −3
Original line number Diff line number Diff line
@@ -791,7 +791,7 @@ static void blkif_restart_queue(struct work_struct *work) 
static void blkif_free(struct blkfront_info *info, int suspend)

{

	struct llist_node *all_gnts;

	struct grant *persistent_gnt;

	struct grant *persistent_gnt, *tmp;

	struct llist_node *n;



	/* Prevent new requests being issued until we fix things up. */
@@ -805,10 +805,17 @@ static void blkif_free(struct blkfront_info *info, int suspend) 
	/* Remove all persistent grants */

	if (info->persistent_gnts_c) {

		all_gnts = llist_del_all(&info->persistent_gnts);

		llist_for_each_entry_safe(persistent_gnt, n, all_gnts, node) {

		persistent_gnt = llist_entry(all_gnts, typeof(*(persistent_gnt)), node);

		while (persistent_gnt) {

			gnttab_end_foreign_access(persistent_gnt->gref, 0, 0UL);

			__free_page(pfn_to_page(persistent_gnt->pfn));

			kfree(persistent_gnt);

			tmp = persistent_gnt;

			n = persistent_gnt->node.next;

			if (n)

				persistent_gnt = llist_entry(n, typeof(*(persistent_gnt)), node);

			else

				persistent_gnt = NULL;

			kfree(tmp);

		}

		info->persistent_gnts_c = 0;

	}

include/linux/llist.h

+0 −25
Original line number Diff line number Diff line
@@ -124,31 +124,6 @@ static inline void init_llist_head(struct llist_head *list) 
	     &(pos)->member != NULL;					\

	     (pos) = llist_entry((pos)->member.next, typeof(*(pos)), member))



/**

 * llist_for_each_entry_safe - iterate safely against remove over some entries

 * of lock-less list of given type.

 * @pos:	the type * to use as a loop cursor.

 * @n:		another type * to use as a temporary storage.

 * @node:	the fist entry of deleted list entries.

 * @member:	the name of the llist_node with the struct.

 *

 * In general, some entries of the lock-less list can be traversed

 * safely only after being removed from list, so start with an entry

 * instead of list head. This variant allows removal of entries

 * as we iterate.

 *

 * If being used on entries deleted from lock-less list directly, the

 * traverse order is from the newest to the oldest added entry.  If

 * you want to traverse from the oldest to the newest, you must

 * reverse the order by yourself before traversing.

 */

#define llist_for_each_entry_safe(pos, n, node, member)		\

	for ((pos) = llist_entry((node), typeof(*(pos)), member),	\

	     (n) = (pos)->member.next;					\

	     &(pos)->member != NULL;					\

	     (pos) = llist_entry(n, typeof(*(pos)), member),		\

	     (n) = (&(pos)->member != NULL) ? (pos)->member.next : NULL)



/**

 * llist_empty - tests whether a lock-less list is empty

 * @head:	the list to test