Re: [patch] f2fs: use _safe() version of list_for_each

All of lore.kernel.org
 help / color / mirror / Atom feed

From: Dan Carpenter <dan.carpenter@oracle.com>
To: Namjae Jeon <linkinjeon@gmail.com>
Cc: Jaegeuk Kim <jaegeuk.kim@samsung.com>,
	linux-f2fs-devel@lists.sourceforge.net,
	linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [patch] f2fs: use _safe() version of list_for_each
Date: Mon, 21 Jan 2013 08:25:31 +0000	[thread overview]
Message-ID: <20130121082531.GS4584@mwanda> (raw)
In-Reply-To: <CAKYAXd_Lp7f-cHi-1Cti29JjmXTWOgOOHxy-_f106jTSFdceDg@mail.gmail.com>

On Mon, Jan 21, 2013 at 09:39:43AM +0900, Namjae Jeon wrote:
> 2013/1/21, Dan Carpenter <dan.carpenter@oracle.com>:
> > This is calling list_del() inside a loop which is a problem when we try
> > move to the next item on the list.  I've converted it to use the _safe
> > version.  And also, as a cleanup, I've converted it to use
> > list_for_each_entry instead of list_for_each.
> >
> Hi Dan.
> I can't understand why this patch is needed yet.
> Could you elaborate more ?
> 

In this case "this", "entry" and "&entry->list" are all the same
pointer, but just casted differently.  The call to list_del() sets
"&entry->list->next = LIST_POISON1;".  On the next iteration "entry"
now points to LIST_POISON1 so the iput(entry->inode); will cause an
Oops.

This was a static checker patch and I didn't test it, but I would
have expected that it would be easy to trigger...

regards,
dan carpenter

WARNING: multiple messages have this Message-ID (diff)

From: Dan Carpenter <dan.carpenter@oracle.com>
To: Namjae Jeon <linkinjeon@gmail.com>
Cc: Jaegeuk Kim <jaegeuk.kim@samsung.com>,
	linux-f2fs-devel@lists.sourceforge.net,
	linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [patch] f2fs: use _safe() version of list_for_each
Date: Mon, 21 Jan 2013 11:25:31 +0300	[thread overview]
Message-ID: <20130121082531.GS4584@mwanda> (raw)
In-Reply-To: <CAKYAXd_Lp7f-cHi-1Cti29JjmXTWOgOOHxy-_f106jTSFdceDg@mail.gmail.com>

On Mon, Jan 21, 2013 at 09:39:43AM +0900, Namjae Jeon wrote:
> 2013/1/21, Dan Carpenter <dan.carpenter@oracle.com>:
> > This is calling list_del() inside a loop which is a problem when we try
> > move to the next item on the list.  I've converted it to use the _safe
> > version.  And also, as a cleanup, I've converted it to use
> > list_for_each_entry instead of list_for_each.
> >
> Hi Dan.
> I can't understand why this patch is needed yet.
> Could you elaborate more ?
> 

In this case "this", "entry" and "&entry->list" are all the same
pointer, but just casted differently.  The call to list_del() sets
"&entry->list->next = LIST_POISON1;".  On the next iteration "entry"
now points to LIST_POISON1 so the iput(entry->inode); will cause an
Oops.

This was a static checker patch and I didn't test it, but I would
have expected that it would be easy to trigger...

regards,
dan carpenter

next prev parent reply	other threads:[~2013-01-21  8:25 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-01-20 15:02 [patch] f2fs: use _safe() version of list_for_each Dan Carpenter
2013-01-20 15:02 ` Dan Carpenter
2013-01-21  0:39 ` Namjae Jeon
2013-01-21  0:39   ` Namjae Jeon
2013-01-21  8:25   ` Dan Carpenter [this message]
2013-01-21  8:25     ` Dan Carpenter
2013-01-21  8:34   ` Dmitry Torokhov
2013-01-21  8:34     ` Dmitry Torokhov
2013-01-21  8:32 ` Dmitry Torokhov
2013-01-21  8:32   ` Dmitry Torokhov
2013-01-21  9:20   ` Jaegeuk Kim
2013-01-21  9:20     ` Jaegeuk Kim
2013-01-21 10:27     ` Namjae Jeon
2013-01-21 10:27       ` Namjae Jeon
2013-01-21 10:37       ` Julia Lawall
2013-01-21 10:37         ` Julia Lawall
2013-01-21 11:24       ` Dan Carpenter
2013-01-21 11:24         ` Dan Carpenter
2013-01-21 12:04         ` Namjae Jeon
2013-01-21 12:04           ` Namjae Jeon

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20130121082531.GS4584@mwanda \
    --to=dan.carpenter@oracle.com \
    --cc=jaegeuk.kim@samsung.com \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=linkinjeon@gmail.com \
    --cc=linux-f2fs-devel@lists.sourceforge.net \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.