From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1422771Ab3FUAcw (ORCPT ); Thu, 20 Jun 2013 20:32:52 -0400 Received: from mail-gh0-f172.google.com ([209.85.160.172]:53912 "EHLO mail-gh0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965778Ab3FUAcv (ORCPT ); Thu, 20 Jun 2013 20:32:51 -0400 Date: Thu, 20 Jun 2013 17:32:44 -0700 From: Tejun Heo To: "Paul E. McKenney" , Dipankar Sarma Cc: Fengguang Wu , "David S. Miller" , Li Zefan , Patrick McHardy , linux-kernel@vger.kernel.org Subject: [PATCH] rculist: list_first_or_null_rcu() should use list_entry_rcu() Message-ID: <20130621003244.GD11837@mtj.dyndns.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org list_first_or_null() should test whether the list is empty and return pointer to the first entry if not in a RCU safe manner. It's broken in two ways. * It compares __kernel @__ptr with __rcu @__next triggering the following sparse warning. net/core/dev.c:4331:17: error: incompatible types in comparison expression (different address spaces) * It doesn't perform rcu_dereference*() and computes the entry address using container_of() directly from the __rcu pointer which is inconsitent with other rculist interface. As a result, all three in-kernel users - net/core/dev.c, macvlan, cgroup - are buggy. They dereference the pointer w/o going through read barrier. Fix it by making list_first_or_null_rcu() dereference ->next directly and then use list_entry_rcu() on it like other rculist accessors. Signed-off-by: Tejun Heo Reported-by: Fengguang Wu Cc: Dipankar Sarma Cc: "Paul E. McKenney" Cc: "David S. Miller" Cc: Li Zefan Cc: Patrick McHardy Cc: stable@vger.kernel.org --- include/linux/rculist.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/include/linux/rculist.h +++ b/include/linux/rculist.h @@ -267,8 +267,9 @@ static inline void list_splice_init_rcu( */ #define list_first_or_null_rcu(ptr, type, member) \ ({struct list_head *__ptr = (ptr); \ - struct list_head __rcu *__next = list_next_rcu(__ptr); \ - likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \ + struct list_head *__next = __ptr->next; \ + likely(__ptr != __next) ? \ + list_entry_rcu(__next, type, member) : NULL; \ }) /**