Skip to content

Commit 4baccdc

Browse files
gaojunhao0504wenlingz
authored andcommitted
dm: reduce potential crash caused by LIST_FOREACH
When removing node in list, list_foreach_safe will be safer than LIST_FOREACH. Tracked-On: #4083 Signed-off-by: Junhao Gao <junhao.gao@intel.com> Signed-off-by: Yonghua Huang <yonghua.huang@intel.com> Reviewed-by: Yonghua Huang <yonghua.huang@intel.com> Acked-by: Yu Wang <yu1.wang@intel.com>
1 parent 2e054f6 commit 4baccdc

File tree

2 files changed

+7
-6
lines changed

2 files changed

+7
-6
lines changed

devicemodel/hw/pci/gsi_sharing.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
#include <pciaccess.h>
1414

1515
#include "pci_core.h"
16+
#include "mevent.h"
1617

1718
#define MAX_DEV_PER_GSI 4
1819

@@ -117,7 +118,7 @@ create_gsi_sharing_groups(void)
117118
uint8_t gsi;
118119
char *dev_name;
119120
int i, error, msi_support;
120-
struct gsi_sharing_group *group = NULL;
121+
struct gsi_sharing_group *group = NULL, *temp = NULL;
121122

122123
error = pciaccess_init();
123124
if (error < 0)
@@ -144,7 +145,7 @@ create_gsi_sharing_groups(void)
144145
* clean up gsg_head - the list for gsi_sharing_group
145146
* delete the element without gsi sharing condition (shared_dev_num < 2)
146147
*/
147-
LIST_FOREACH(group, &gsg_head, gsg_list) {
148+
list_foreach_safe(group, &gsg_head, gsg_list, temp) {
148149
if (group->shared_dev_num < 2) {
149150
LIST_REMOVE(group, gsg_list);
150151
free(group);
@@ -181,7 +182,7 @@ update_pt_info(uint16_t phys_bdf)
181182
int
182183
check_gsi_sharing_violation(void)
183184
{
184-
struct gsi_sharing_group *group;
185+
struct gsi_sharing_group *group, *temp;
185186
int i, error, violation;
186187

187188
error = 0;
@@ -226,7 +227,7 @@ check_gsi_sharing_violation(void)
226227
}
227228

228229
/* destroy the gsg_head after all the checks have been done */
229-
LIST_FOREACH(group, &gsg_head, gsg_list) {
230+
list_foreach_safe(group, &gsg_head, gsg_list, temp) {
230231
LIST_REMOVE(group, gsg_list);
231232
free(group);
232233
}

devicemodel/hw/pci/virtio/virtio_mei.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -937,7 +937,7 @@ static void
937937
vmei_virtual_fw_reset(struct virtio_mei *vmei)
938938
{
939939
DPRINTF("Firmware reset\n");
940-
struct vmei_me_client *e;
940+
struct vmei_me_client *e, *temp;
941941

942942
vmei_set_status(vmei, VMEI_STS_RESET);
943943
vmei->config->hw_ready = 0;
@@ -948,7 +948,7 @@ vmei_virtual_fw_reset(struct virtio_mei *vmei)
948948

949949
/* disconnect all */
950950
pthread_mutex_lock(&vmei->list_mutex);
951-
LIST_FOREACH(e, &vmei->active_clients, list) {
951+
list_foreach_safe(e, &vmei->active_clients, list, temp) {
952952
vmei_me_client_destroy_host_clients(e);
953953
}
954954
pthread_mutex_unlock(&vmei->list_mutex);

0 commit comments

Comments
 (0)