patch-2.4.25 linux-2.4.25/drivers/md/lvm-snap.c

• Lines: 29
• Date: 2004-02-18 05:36:31.000000000 -0800
• Orig file: linux-2.4.24/drivers/md/lvm-snap.c
• Orig date: 2003-11-28 10:26:20.000000000 -0800

diff -urN linux-2.4.24/drivers/md/lvm-snap.c linux-2.4.25/drivers/md/lvm-snap.c
@@ -44,6 +44,7 @@
  *    26/06/2002 - support for new list_move macro [patch@luckynet.dynu.com]
  *    26/07/2002 - removed conditional list_move macro because we will
  *                 discontinue LVM1 before 2.6 anyway
+ *    27/08/2003 - fixed unsafe list handling in lvm_find_exception_table() [HM]
  *
  */
 
@@ -114,7 +115,7 @@
 							     org_start,
 							     lv_t * lv)
 {
-	struct list_head *hash_table = lv->lv_snapshot_hash_table, *next;
+	struct list_head *hash_table = lv->lv_snapshot_hash_table, *next, *n;
 	unsigned long mask = lv->lv_snapshot_hash_mask;
 	int chunk_size = lv->lv_chunk_size;
 	lv_block_exception_t *ret;
@@ -123,8 +124,9 @@
 	hash_table =
 	    &hash_table[hashfn(org_dev, org_start, mask, chunk_size)];
 	ret = NULL;
-	for (next = hash_table->next; next != hash_table;
-	     next = next->next) {
+
+	for (next = hash_table->next, n = next->next; next != hash_table;
+             next = n, n = next->next) {
 		lv_block_exception_t *exception;
 
 		exception = list_entry(next, lv_block_exception_t, hash);