From 077ff173149bccad625826f5bef026884129bb9e Mon Sep 17 00:00:00 2001 From: Lai Jiangshan Date: Thu, 15 Sep 2011 11:14:43 -0400 Subject: [PATCH] urcu call_rcu: fix use after free() call_rcu_after_fork_child() needs to use cds_list_for_each_entry_safe to safely iterate on the list as its item is being freed. Signed-off-by: Lai Jiangshan Signed-off-by: Mathieu Desnoyers --- urcu-call-rcu-impl.h | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/urcu-call-rcu-impl.h b/urcu-call-rcu-impl.h index 1fbce98..6cb08be 100644 --- a/urcu-call-rcu-impl.h +++ b/urcu-call-rcu-impl.h @@ -651,7 +651,7 @@ void call_rcu_after_fork_parent(void) */ void call_rcu_after_fork_child(void) { - struct call_rcu_data *crdp; + struct call_rcu_data *crdp, *next; /* Release the mutex. */ call_rcu_unlock(&call_rcu_mutex); @@ -664,12 +664,9 @@ void call_rcu_after_fork_child(void) (void)get_default_call_rcu_data(); /* Dispose of all of the rest of the call_rcu_data structures. */ - while (call_rcu_data_list.next != call_rcu_data_list.prev) { - crdp = cds_list_entry(call_rcu_data_list.prev, - struct call_rcu_data, list); + cds_list_for_each_entry_safe(crdp, next, &call_rcu_data_list, list) { if (crdp == default_call_rcu_data) - crdp = cds_list_entry(crdp->list.prev, - struct call_rcu_data, list); + continue; uatomic_set(&crdp->flags, URCU_CALL_RCU_STOPPED); call_rcu_data_free(crdp); } -- 2.34.1