diff options
author | Mark Johnston <markj@FreeBSD.org> | 2015-07-30 18:28:37 +0000 |
---|---|---|
committer | Mark Johnston <markj@FreeBSD.org> | 2015-07-30 18:28:37 +0000 |
commit | e2e45da0e80379aa1c8c9e9838b85cfc1bd0e6a5 (patch) | |
tree | 627e911627f211695b77d1259d8945ba011ad3c5 /sys/ofed | |
parent | 6a875bf929d097f2bf55655da0d6fab553461936 (diff) | |
download | src-e2e45da0e80379aa1c8c9e9838b85cfc1bd0e6a5.tar.gz src-e2e45da0e80379aa1c8c9e9838b85cfc1bd0e6a5.zip |
ib mad: fix an incorrect use of list_for_each_entry
In tf_dequeue(), if we reach the end of the list without finding a
non-cancelled element, "tmp" will be a pointer into the list head, so the
tmp->canceled check is bogus. Use a flag instead.
Submitted by: Tao Liu <Tao.Liu@isilon.com>
Reviewed by: hselasky
MFC after: 1 week
Sponsored by: EMC / Isilon Storage Division
Differential Revision: https://reviews.freebsd.org/D3244
Notes
Notes:
svn path=/head/; revision=286087
Diffstat (limited to 'sys/ofed')
-rw-r--r-- | sys/ofed/drivers/infiniband/core/mad.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/sys/ofed/drivers/infiniband/core/mad.c b/sys/ofed/drivers/infiniband/core/mad.c index 11b3ba372186..3eedca1d6b6a 100644 --- a/sys/ofed/drivers/infiniband/core/mad.c +++ b/sys/ofed/drivers/infiniband/core/mad.c @@ -292,6 +292,7 @@ static struct tf_entry *tf_dequeue(struct to_fifo *tf, u32 *time_left_ms) unsigned long flags; unsigned long time_left; struct tf_entry *tmp, *tmp1; + bool found = false; spin_lock_irqsave(&tf->lists_lock, flags); if (list_empty(&tf->fifo_head)) { @@ -300,11 +301,13 @@ static struct tf_entry *tf_dequeue(struct to_fifo *tf, u32 *time_left_ms) } list_for_each_entry(tmp, &tf->fifo_head, fifo_list) { - if (!tmp->canceled) + if (!tmp->canceled) { + found = true; break; + } } - if (tmp->canceled) { + if (!found) { spin_unlock_irqrestore(&tf->lists_lock, flags); return NULL; } |