[PATCH 1/2] drbd: remove usage of list iterator variable after loop for list_for_each_entry_safe_from()

[PATCH 1/2] drbd: remove usage of list iterator variable after loop for list_for_each_entry_safe_from()

[Jakob Koschel]

In preparation to limit the scope of a list iterator to the list
traversal loop, use a dedicated pointer to iterate through the list [1].

Since that variable should not be used past the loop iteration, a
separate variable is used to 'remember the current location within the
loop'.

To either continue iterating from that position or skip the iteration
(if the previous iteration was complete) list_prepare_entry() is used.

Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1]
Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
---
 drivers/block/drbd/drbd_main.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 96881d5babd9..9676a1d214bc 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -171,7 +171,7 @@ void tl_release(struct drbd_connection *connection, unsigned int barrier_nr,
 		unsigned int set_size)
 {
 	struct drbd_request *r;
-	struct drbd_request *req = NULL;
+	struct drbd_request *req = NULL, *tmp = NULL;
 	int expect_epoch = 0;
 	int expect_size = 0;
 
@@ -225,8 +225,11 @@ void tl_release(struct drbd_connection *connection, unsigned int barrier_nr,
 	 * to catch requests being barrier-acked "unexpectedly".
 	 * It usually should find the same req again, or some READ preceding it. */
 	list_for_each_entry(req, &connection->transfer_log, tl_requests)
-		if (req->epoch == expect_epoch)
+		if (req->epoch == expect_epoch) {
+			tmp = req;
 			break;
+		}
+	req = list_prepare_entry(tmp, &connection->transfer_log, tl_requests);
 	list_for_each_entry_safe_from(req, r, &connection->transfer_log, tl_requests) {
 		if (req->epoch != expect_epoch)
 			break;

base-commit: f82da161ea75dc4db21b2499e4b1facd36dab275
-- 
2.25.1

[PATCH 2/2] drbd: remove check of list iterator against head past the loop body

[Jakob Koschel]

When list_for_each_entry() completes the iteration over the whole list
without breaking the loop, the iterator value will be a bogus pointer
computed based on the head element.

While it is safe to use the pointer to determine if it was computed
based on the head element, either with list_entry_is_head() or
&pos->member == head, using the iterator variable after the loop should
be avoided.

In preparation to limit the scope of a list iterator to the list
traversal loop, use a dedicated pointer to point to the found element [1].

Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1]
Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
---
 drivers/block/drbd/drbd_req.c | 42 ++++++++++++++++++++++-------------
 1 file changed, 27 insertions(+), 15 deletions(-)

diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index c04394518b07..b2571dc77fe6 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -332,17 +332,21 @@ static void set_if_null_req_next(struct drbd_peer_device *peer_device, struct dr
 static void advance_conn_req_next(struct drbd_peer_device *peer_device, struct drbd_request *req)
 {
 	struct drbd_connection *connection = peer_device ? peer_device->connection : NULL;
+	struct drbd_request *iter = req;
 	if (!connection)
 		return;
 	if (connection->req_next != req)
 		return;
-	list_for_each_entry_continue(req, &connection->transfer_log, tl_requests) {
-		const unsigned s = req->rq_state;
-		if (s & RQ_NET_QUEUED)
+
+	req = NULL;
+	list_for_each_entry_continue(iter, &connection->transfer_log, tl_requests) {
+		const unsigned int s = iter->rq_state;
+
+		if (s & RQ_NET_QUEUED) {
+			req = iter;
 			break;
+		}
 	}
-	if (&req->tl_requests == &connection->transfer_log)
-		req = NULL;
 	connection->req_next = req;
 }
 
@@ -358,17 +362,21 @@ static void set_if_null_req_ack_pending(struct drbd_peer_device *peer_device, st
 static void advance_conn_req_ack_pending(struct drbd_peer_device *peer_device, struct drbd_request *req)
 {
 	struct drbd_connection *connection = peer_device ? peer_device->connection : NULL;
+	struct drbd_request *iter = req;
 	if (!connection)
 		return;
 	if (connection->req_ack_pending != req)
 		return;
-	list_for_each_entry_continue(req, &connection->transfer_log, tl_requests) {
-		const unsigned s = req->rq_state;
-		if ((s & RQ_NET_SENT) && (s & RQ_NET_PENDING))
+
+	req = NULL;
+	list_for_each_entry_continue(iter, &connection->transfer_log, tl_requests) {
+		const unsigned int s = iter->rq_state;
+
+		if ((s & RQ_NET_SENT) && (s & RQ_NET_PENDING)) {
+			req = iter;
 			break;
+		}
 	}
-	if (&req->tl_requests == &connection->transfer_log)
-		req = NULL;
 	connection->req_ack_pending = req;
 }
 
@@ -384,17 +392,21 @@ static void set_if_null_req_not_net_done(struct drbd_peer_device *peer_device, s
 static void advance_conn_req_not_net_done(struct drbd_peer_device *peer_device, struct drbd_request *req)
 {
 	struct drbd_connection *connection = peer_device ? peer_device->connection : NULL;
+	struct drbd_request *iter = req;
 	if (!connection)
 		return;
 	if (connection->req_not_net_done != req)
 		return;
-	list_for_each_entry_continue(req, &connection->transfer_log, tl_requests) {
-		const unsigned s = req->rq_state;
-		if ((s & RQ_NET_SENT) && !(s & RQ_NET_DONE))
+
+	req = NULL;
+	list_for_each_entry_continue(iter, &connection->transfer_log, tl_requests) {
+		const unsigned int s = iter->rq_state;
+
+		if ((s & RQ_NET_SENT) && !(s & RQ_NET_DONE)) {
+			req = iter;
 			break;
+		}
 	}
-	if (&req->tl_requests == &connection->transfer_log)
-		req = NULL;
 	connection->req_not_net_done = req;
 }
 
-- 
2.25.1

Re: [Drbd-dev] [PATCH 2/2] drbd: remove check of list iterator against head past the loop body

[Christoph Böhmwalder]

Am 01.04.22 um 00:03 schrieb Jakob Koschel:
> When list_for_each_entry() completes the iteration over the whole list
> without breaking the loop, the iterator value will be a bogus pointer
> computed based on the head element.
> 
> While it is safe to use the pointer to determine if it was computed
> based on the head element, either with list_entry_is_head() or
> &pos->member == head, using the iterator variable after the loop should
> be avoided.
> 
> In preparation to limit the scope of a list iterator to the list
> traversal loop, use a dedicated pointer to point to the found element [1].
> 
> Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1]
> Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
> ---
>   drivers/block/drbd/drbd_req.c | 42 ++++++++++++++++++++++-------------
>   1 file changed, 27 insertions(+), 15 deletions(-)
> 
> diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
> index c04394518b07..b2571dc77fe6 100644
> --- a/drivers/block/drbd/drbd_req.c
> +++ b/drivers/block/drbd/drbd_req.c
> @@ -332,17 +332,21 @@ static void set_if_null_req_next(struct drbd_peer_device *peer_device, struct dr
>   static void advance_conn_req_next(struct drbd_peer_device *peer_device, struct drbd_request *req)
>   {
>   	struct drbd_connection *connection = peer_device ? peer_device->connection : NULL;
> +	struct drbd_request *iter = req;
>   	if (!connection)
>   		return;
>   	if (connection->req_next != req)
>   		return;
> -	list_for_each_entry_continue(req, &connection->transfer_log, tl_requests) {
> -		const unsigned s = req->rq_state;
> -		if (s & RQ_NET_QUEUED)
> +
> +	req = NULL;
> +	list_for_each_entry_continue(iter, &connection->transfer_log, tl_requests) {
> +		const unsigned int s = iter->rq_state;
> +
> +		if (s & RQ_NET_QUEUED) {
> +			req = iter;
>   			break;
> +		}
>   	}
> -	if (&req->tl_requests == &connection->transfer_log)
> -		req = NULL;
>   	connection->req_next = req;
>   }
>   
> @@ -358,17 +362,21 @@ static void set_if_null_req_ack_pending(struct drbd_peer_device *peer_device, st
>   static void advance_conn_req_ack_pending(struct drbd_peer_device *peer_device, struct drbd_request *req)
>   {
>   	struct drbd_connection *connection = peer_device ? peer_device->connection : NULL;
> +	struct drbd_request *iter = req;
>   	if (!connection)
>   		return;
>   	if (connection->req_ack_pending != req)
>   		return;
> -	list_for_each_entry_continue(req, &connection->transfer_log, tl_requests) {
> -		const unsigned s = req->rq_state;
> -		if ((s & RQ_NET_SENT) && (s & RQ_NET_PENDING))
> +
> +	req = NULL;
> +	list_for_each_entry_continue(iter, &connection->transfer_log, tl_requests) {
> +		const unsigned int s = iter->rq_state;
> +
> +		if ((s & RQ_NET_SENT) && (s & RQ_NET_PENDING)) {
> +			req = iter;
>   			break;
> +		}
>   	}
> -	if (&req->tl_requests == &connection->transfer_log)
> -		req = NULL;
>   	connection->req_ack_pending = req;
>   }
>   
> @@ -384,17 +392,21 @@ static void set_if_null_req_not_net_done(struct drbd_peer_device *peer_device, s
>   static void advance_conn_req_not_net_done(struct drbd_peer_device *peer_device, struct drbd_request *req)
>   {
>   	struct drbd_connection *connection = peer_device ? peer_device->connection : NULL;
> +	struct drbd_request *iter = req;
>   	if (!connection)
>   		return;
>   	if (connection->req_not_net_done != req)
>   		return;
> -	list_for_each_entry_continue(req, &connection->transfer_log, tl_requests) {
> -		const unsigned s = req->rq_state;
> -		if ((s & RQ_NET_SENT) && !(s & RQ_NET_DONE))
> +
> +	req = NULL;
> +	list_for_each_entry_continue(iter, &connection->transfer_log, tl_requests) {
> +		const unsigned int s = iter->rq_state;
> +
> +		if ((s & RQ_NET_SENT) && !(s & RQ_NET_DONE)) {
> +			req = iter;
>   			break;
> +		}
>   	}
> -	if (&req->tl_requests == &connection->transfer_log)
> -		req = NULL;
>   	connection->req_not_net_done = req;
>   }
>   

Hi Jakob,

Both of these look good to me, thanks.

Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>

Regards, Christoph

Re: [Drbd-dev] [PATCH 2/2] drbd: remove check of list iterator against head past the loop body

[Jens Axboe]

On 3/31/22 4:28 PM, Christoph B?hmwalder wrote:
> Am 01.04.22 um 00:03 schrieb Jakob Koschel:
>> When list_for_each_entry() completes the iteration over the whole list
>> without breaking the loop, the iterator value will be a bogus pointer
>> computed based on the head element.
>>
>> While it is safe to use the pointer to determine if it was computed
>> based on the head element, either with list_entry_is_head() or
>> &pos->member == head, using the iterator variable after the loop should
>> be avoided.
>>
>> In preparation to limit the scope of a list iterator to the list
>> traversal loop, use a dedicated pointer to point to the found element [1].
>>
> 
> Hi Jakob,
> 
> Both of these look good to me, thanks.
> 
> Reviewed-by: Christoph B?hmwalder <christoph.boehmwalder@linbit.com>

Applied both, but shortened title of this commit. Jakob, please keep it
within the usual 74 chars. In general, it's great to use a cover letter
for anything that's more than one patch. Just some pointers if you're
doing more of these.

-- 
Jens Axboe

Re: [PATCH 1/2] drbd: remove usage of list iterator variable after loop for list_for_each_entry_safe_from()

[Jens Axboe]

On Fri, 1 Apr 2022 00:03:48 +0200, Jakob Koschel wrote:
> In preparation to limit the scope of a list iterator to the list
> traversal loop, use a dedicated pointer to iterate through the list [1].
> 
> Since that variable should not be used past the loop iteration, a
> separate variable is used to 'remember the current location within the
> loop'.
> 
> [...]

Applied, thanks!

[1/2] drbd: remove usage of list iterator variable after loop for list_for_each_entry_safe_from()
      commit: 901aeda62efa21f2eae937bccb71b49ae531be06
[2/2] drbd: remove check of list iterator against head past the loop body
      commit: 2651ee5ae43241831ca63d7158bb2b151a6a0e1f

Best regards,
-- 
Jens Axboe