llist/xen-blkfront: implement safe version of llist_for_each_entry

Implement a safe version of llist_for_each_entry, and use it in
blkif_free. Previously grants where freed while iterating the list,
which lead to dereferences when trying to fetch the next item.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by:  Andrew Morton <akpm@linux-foundation.org>
[v2: Move the llist_for_each_entry_safe in llist.h]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 96e9b00db081..cfdb033c7107 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -792,6 +792,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
 {
         struct llist_node *all_gnts;
         struct grant *persistent_gnt;
+        struct llist_node *n;
 
         /* Prevent new requests being issued until we fix things up. */
         spin_lock_irq(&info->io_lock);
@@ -804,7 +805,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
         /* Remove all persistent grants */
         if (info->persistent_gnts_c) {
                 all_gnts = llist_del_all(&info->persistent_gnts);
-                llist_for_each_entry(persistent_gnt, all_gnts, node) {
+                llist_for_each_entry_safe(persistent_gnt, n, all_gnts, node) {
                         gnttab_end_foreign_access(persistent_gnt->gref, 0, 0UL);
                         __free_page(pfn_to_page(persistent_gnt->pfn));
                         kfree(persistent_gnt);