diff options
| author | Maoyi Xie <maoyixie.tju@gmail.com> | 2026-05-25 10:17:59 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-05-27 04:03:46 +0300 |
| commit | 6373d6fbc2429abbad1cc0f6f0c26fb227ed97cd (patch) | |
| tree | 96c778ab78a7d961c165844613777456c7d0fc4c /include | |
| parent | 10006ad04b74a81ba15f63e94f6310773b45b043 (diff) | |
| download | linux-6373d6fbc2429abbad1cc0f6f0c26fb227ed97cd.tar.xz | |
mlxsw: spectrum_fid: use a dedicated list head pointer for sorted insert
mlxsw_sp_fid_port_vid_list_add() inserts into a list sorted by
local_port. It walks the list to find the first entry with a
larger local_port, then inserts the new entry before it:
list_add_tail(&port_vid->list, &tmp_port_vid->list);
If the loop falls through (the new local_port is the largest),
tmp_port_vid runs off the end of the list. &tmp_port_vid->list
then ends up at the list head itself (container_of() offsets
cancel), and list_add_tail() inserts at the tail. So the code
works today.
It is fragile though. Anyone who later adds a read of another
field of tmp_port_vid will hit memory outside the list head.
Track the insertion point with a dedicated list_head pointer.
Initialise insert_before to &fid->port_vid_list, set it to
&tmp_port_vid->list only on early break, and pass insert_before
to list_add_tail(). The cursor is no longer touched after the
loop. Behaviour is unchanged.
Same shape as the Koschel cleanups from 2022 (e.g. 99d8ae4ec8a
tracing, 2966a9918df clockevents, dc1acd5c946 dlm).
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260525071759.1517576-1-maoyixie.tju@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions
