diff mbox

[dpdk-dev,v2] mempool: fix unsafe removal from list by callback

Message ID 1469476476-2148-1-git-send-email-thomas.monjalon@6wind.com (mailing list archive)
State Accepted, archived
Headers

Commit Message

Thomas Monjalon July 25, 2016, 7:54 p.m. UTC 
  If a mempool is removed from the list by a callback function
during rte_mempool_walk(), the TAILQ_FOREACH loop will fail unexpectedly.
It is fixed by using the safe version of the loop macro.

Reported-by: Sergio Gonzalez Monroy <sergio.gonzalez.monroy@intel.com>
Signed-off-by: Thomas Monjalon <thomas.monjalon@6wind.com>
---
 lib/librte_mempool/rte_mempool.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Olivier Matz July 25, 2016, 8:09 p.m. UTC | #1 
Hello Thomas,

On 07/25/2016 09:54 PM, Thomas Monjalon wrote:
> If a mempool is removed from the list by a callback function
> during rte_mempool_walk(), the TAILQ_FOREACH loop will fail unexpectedly.
> It is fixed by using the safe version of the loop macro.
> 
> Reported-by: Sergio Gonzalez Monroy <sergio.gonzalez.monroy@intel.com>
> Signed-off-by: Thomas Monjalon <thomas.monjalon@6wind.com>
> ---
>  lib/librte_mempool/rte_mempool.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/lib/librte_mempool/rte_mempool.c b/lib/librte_mempool/rte_mempool.c
> index 8806633..2e28e2e 100644
> --- a/lib/librte_mempool/rte_mempool.c
> +++ b/lib/librte_mempool/rte_mempool.c
> @@ -1283,12 +1283,13 @@ void rte_mempool_walk(void (*func)(struct rte_mempool *, void *),
>  {
>  	struct rte_tailq_entry *te = NULL;
>  	struct rte_mempool_list *mempool_list;
> +	void *tmp_te;
>  
>  	mempool_list = RTE_TAILQ_CAST(rte_mempool_tailq.head, rte_mempool_list);
>  
>  	rte_rwlock_read_lock(RTE_EAL_MEMPOOL_RWLOCK);
>  
> -	TAILQ_FOREACH(te, mempool_list, next) {
> +	TAILQ_FOREACH_SAFE(te, mempool_list, next, tmp_te) {
>  		(*func)((struct rte_mempool *) te->data, arg);
>  	}
>  
> 

Acked-by: Olivier Matz <olivier.matz@6wind.com>

Thanks
Thomas Monjalon July 25, 2016, 8:21 p.m. UTC | #2 
> > If a mempool is removed from the list by a callback function
> > during rte_mempool_walk(), the TAILQ_FOREACH loop will fail unexpectedly.
> > It is fixed by using the safe version of the loop macro.
> > 
> > Reported-by: Sergio Gonzalez Monroy <sergio.gonzalez.monroy@intel.com>
> > Signed-off-by: Thomas Monjalon <thomas.monjalon@6wind.com>
> 
> Acked-by: Olivier Matz <olivier.matz@6wind.com>

Applied, thanks
diff mbox

Patch

diff --git a/lib/librte_mempool/rte_mempool.c b/lib/librte_mempool/rte_mempool.c
index 8806633..2e28e2e 100644
--- a/lib/librte_mempool/rte_mempool.c
+++ b/lib/librte_mempool/rte_mempool.c
@@ -1283,12 +1283,13 @@  void rte_mempool_walk(void (*func)(struct rte_mempool *, void *),
 {
 	struct rte_tailq_entry *te = NULL;
 	struct rte_mempool_list *mempool_list;
+	void *tmp_te;
 
 	mempool_list = RTE_TAILQ_CAST(rte_mempool_tailq.head, rte_mempool_list);
 
 	rte_rwlock_read_lock(RTE_EAL_MEMPOOL_RWLOCK);
 
-	TAILQ_FOREACH(te, mempool_list, next) {
+	TAILQ_FOREACH_SAFE(te, mempool_list, next, tmp_te) {
 		(*func)((struct rte_mempool *) te->data, arg);
 	}