diff options
| author | markj <markj@FreeBSD.org> | 2015-07-30 18:28:37 +0000 |
|---|---|---|
| committer | markj <markj@FreeBSD.org> | 2015-07-30 18:28:37 +0000 |
| commit | ca7adff0b82acb3e94fa89704aade20774b85bd1 (patch) | |
| tree | 627e911627f211695b77d1259d8945ba011ad3c5 /sys/ofed | |
| parent | 34996cf7cdfd83f387f03c0079faad2bd83f1aa1 (diff) | |
| download | FreeBSD-src-ca7adff0b82acb3e94fa89704aade20774b85bd1.zip FreeBSD-src-ca7adff0b82acb3e94fa89704aade20774b85bd1.tar.gz | |
ib mad: fix an incorrect use of list_for_each_entry
In tf_dequeue(), if we reach the end of the list without finding a
non-cancelled element, "tmp" will be a pointer into the list head, so the
tmp->canceled check is bogus. Use a flag instead.
Submitted by: Tao Liu <Tao.Liu@isilon.com>
Reviewed by: hselasky
MFC after: 1 week
Sponsored by: EMC / Isilon Storage Division
Differential Revision: https://reviews.freebsd.org/D3244
Diffstat (limited to 'sys/ofed')
| -rw-r--r-- | sys/ofed/drivers/infiniband/core/mad.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/sys/ofed/drivers/infiniband/core/mad.c b/sys/ofed/drivers/infiniband/core/mad.c index 11b3ba3..3eedca1 100644 --- a/sys/ofed/drivers/infiniband/core/mad.c +++ b/sys/ofed/drivers/infiniband/core/mad.c @@ -292,6 +292,7 @@ static struct tf_entry *tf_dequeue(struct to_fifo *tf, u32 *time_left_ms) unsigned long flags; unsigned long time_left; struct tf_entry *tmp, *tmp1; + bool found = false; spin_lock_irqsave(&tf->lists_lock, flags); if (list_empty(&tf->fifo_head)) { @@ -300,11 +301,13 @@ static struct tf_entry *tf_dequeue(struct to_fifo *tf, u32 *time_left_ms) } list_for_each_entry(tmp, &tf->fifo_head, fifo_list) { - if (!tmp->canceled) + if (!tmp->canceled) { + found = true; break; + } } - if (tmp->canceled) { + if (!found) { spin_unlock_irqrestore(&tf->lists_lock, flags); return NULL; } |
