[Devel] [PATCH hci-8.1 v7 1/8] block/blk-cbt: don't read a released cbt in blk_cbt_update_size()

[Pavel Tikhomirov]

blk_cbt_update_cbt_size() may replace the cbt in q->cbt_list and queue
the old one for release, and blk_cbt_update_size() then reads the next
entry through the old one. It holds only cbt_mutex, which doesn't delay
the release, so the old cbt may already be freed.

Read the next entry before the call, with list_for_each_entry_safe():
the replacement keeps it, and cbt_mutex excludes other list changes.

https://virtuozzo.atlassian.net/browse/VSTOR-149268
Feature: cbt: changed block tracking (for backup)
Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
---
 block/blk-cbt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/block/blk-cbt.c b/block/blk-cbt.c
index 90219f58f1ae5..f4ee0a664156e 100644
--- a/block/blk-cbt.c
+++ b/block/blk-cbt.c
@@ -604,14 +604,14 @@ static void blk_cbt_update_cbt_size(struct cbt_info *cbt, loff_t new_sz)
 void blk_cbt_update_size(struct block_device *bdev)
 {
 	struct request_queue *q;
-	struct cbt_info *cbt;
+	struct cbt_info *cbt, *tmp;
 
 	if (!bdev->bd_disk || !bdev_get_queue(bdev))
 		return;
 
 	q = bdev_get_queue(bdev);
 	mutex_lock(&cbt_mutex);
-	list_for_each_entry(cbt, &q->cbt_list, list)
+	list_for_each_entry_safe(cbt, tmp, &q->cbt_list, list)
 		blk_cbt_update_cbt_size(cbt, bdev_nr_bytes(bdev));
 
 	mutex_unlock(&cbt_mutex);

-- 
2.55.0