Messages in this thread | | | Date | Mon, 12 Apr 2010 13:25:58 +0300 | From | Avi Kivity <> | Subject | Re: [PATCH 2/6] KVM MMU: fix kvm_mmu_zap_page() and its calling path |
| |
On 04/12/2010 12:22 PM, Xiao Guangrong wrote: > Hi Avi, > > Avi Kivity wrote: > > >> hlist_for_each_entry_safe() is supposed to be be safe against removal of >> the element that is pointed to by the iteration cursor. >> > If we destroyed the next point, hlist_for_each_entry_safe() is unsafe. > > List hlist_for_each_entry_safe()'s code: > > |#define hlist_for_each_entry_safe(tpos, pos, n, head, member) \ > | for (pos = (head)->first; \ > | pos&& ({ n = pos->next; 1; })&& \ > | ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \ > | pos = n) > > if n is destroyed: > 'pos = n, n = pos->next' > then it access n again, it's unsafe/illegal for us. >
But kvm_mmu_zap_page() will only destroy sp == tpos == pos; n points at pos->next already, so it's safe.
-- I have a truly marvellous patch that fixes the bug which this signature is too narrow to contain.
| |