path: root/lib
diff options
authorJames Bottomley <>2005-09-06 16:56:51 -0700
committerLinus Torvalds <>2005-09-07 18:26:54 -0700
commit34bb61f9ddabd7a7f909cbfb05592eb775f6662a (patch)
tree06232f6fc975bd279236fd8005c7d5528220ec68 /lib
parentdf4edad1787bbfa3c9c10824e4f11e9f4a7ec5c6 (diff)
[PATCH] fix klist semantics for lists which have elements removed on traversal
The problem is that klists claim to provide semantics for safe traversal of lists which are being modified. The failure case is when traversal of a list causes element removal (a fairly common case). The issue is that although the list node is refcounted, if it is embedded in an object (which is universally the case), then the object will be freed regardless of the klist refcount leading to slab corruption because the klist iterator refers to the prior element to get the next. The solution is to make the klist take and release references to the embedding object meaning that the embedding object won't be released until the list relinquishes the reference to it. (akpm: fast-track this because it's needed for the 2.6.13 scsi merge) Signed-off-by: James Bottomley <> Signed-off-by: Greg Kroah-Hartman <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
Diffstat (limited to 'lib')
1 files changed, 17 insertions, 1 deletions
diff --git a/lib/klist.c b/lib/klist.c
index a70c836c5c4c..bb2f3551d50a 100644
--- a/lib/klist.c
+++ b/lib/klist.c
@@ -42,12 +42,23 @@
* klist_init - Initialize a klist structure.
* @k: The klist we're initializing.
+ * @get: The get function for the embedding object (NULL if none)
+ * @put: The put function for the embedding object (NULL if none)
+ *
+ * Initialises the klist structure. If the klist_node structures are
+ * going to be embedded in refcounted objects (necessary for safe
+ * deletion) then the get/put arguments are used to initialise
+ * functions that take and release references on the embedding
+ * objects.
-void klist_init(struct klist * k)
+void klist_init(struct klist * k, void (*get)(struct klist_node *),
+ void (*put)(struct klist_node *))
+ k->get = get;
+ k->put = put;
@@ -74,6 +85,8 @@ static void klist_node_init(struct klist * k, struct klist_node * n)
n->n_klist = k;
+ if (k->get)
+ k->get(n);
@@ -110,9 +123,12 @@ EXPORT_SYMBOL_GPL(klist_add_tail);
static void klist_release(struct kref * kref)
struct klist_node * n = container_of(kref, struct klist_node, n_ref);
+ void (*put)(struct klist_node *) = n->n_klist->put;
n->n_klist = NULL;
+ if (put)
+ put(n);
static int klist_dec_and_del(struct klist_node * n)