UPSTREAM: binder: fix race that allows malicious free of live buffer
[GitHub/LineageOS/android_kernel_samsung_universal7580.git] / lib / list_debug.c
1 /*
2 * Copyright 2006, Red Hat, Inc., Dave Jones
3 * Released under the General Public License (GPL).
4 *
5 * This file contains the linked list implementations for
6 * DEBUG_LIST.
7 */
8
9 #include <linux/export.h>
10 #include <linux/list.h>
11 #include <linux/bug.h>
12 #include <linux/kernel.h>
13 #include <linux/rculist.h>
14
15 /*
16 * Insert a new entry between two known consecutive entries.
17 *
18 * This is only for internal list manipulation where we know
19 * the prev/next entries already!
20 */
21
22 void __list_add(struct list_head *new,
23 struct list_head *prev,
24 struct list_head *next)
25 {
26 if (WARN(next->prev != prev,
27 "list_add corruption. next->prev should be "
28 "prev (%p), but was %p. (next=%p).\n",
29 prev, next->prev, next) ||
30 WARN(prev->next != next,
31 "list_add corruption. prev->next should be "
32 "next (%p), but was %p. (prev=%p).\n",
33 next, prev->next, prev) ||
34 WARN(new == prev || new == next,
35 "list_add double add: new=%p, prev=%p, next=%p.\n",
36 new, prev, next))
37 BUG_ON(1);
38
39 next->prev = new;
40 new->next = next;
41 new->prev = prev;
42 prev->next = new;
43 }
44 EXPORT_SYMBOL(__list_add);
45
46 void __list_del_entry(struct list_head *entry)
47 {
48 struct list_head *prev, *next;
49
50 prev = entry->prev;
51 next = entry->next;
52
53 if (WARN(next == LIST_POISON1,
54 "list_del corruption, %p->next is LIST_POISON1 (%p)\n",
55 entry, LIST_POISON1) ||
56 WARN(prev == LIST_POISON2,
57 "list_del corruption, %p->prev is LIST_POISON2 (%p)\n",
58 entry, LIST_POISON2) ||
59 WARN(prev->next != entry,
60 "list_del corruption. prev->next should be %p, "
61 "but was %p\n", entry, prev->next) ||
62 WARN(next->prev != entry,
63 "list_del corruption. next->prev should be %p, "
64 "but was %p\n", entry, next->prev))
65 BUG_ON(1);
66
67 __list_del(prev, next);
68 }
69 EXPORT_SYMBOL(__list_del_entry);
70
71 /**
72 * list_del - deletes entry from list.
73 * @entry: the element to delete from the list.
74 * Note: list_empty on entry does not return true after this, the entry is
75 * in an undefined state.
76 */
77 void list_del(struct list_head *entry)
78 {
79 __list_del_entry(entry);
80 entry->next = LIST_POISON1;
81 entry->prev = LIST_POISON2;
82 }
83 EXPORT_SYMBOL(list_del);
84
85 /*
86 * RCU variants.
87 */
88 void __list_add_rcu(struct list_head *new,
89 struct list_head *prev, struct list_head *next)
90 {
91 if (WARN(next->prev != prev,
92 "list_add_rcu corruption. next->prev should be prev (%p), but was %p. (next=%p).\n",
93 prev, next->prev, next) ||
94 WARN(prev->next != next,
95 "list_add_rcu corruption. prev->next should be next (%p), but was %p. (prev=%p).\n",
96 next, prev->next, prev))
97 BUG_ON(1);
98
99 new->next = next;
100 new->prev = prev;
101 rcu_assign_pointer(list_next_rcu(prev), new);
102 next->prev = new;
103 }
104 EXPORT_SYMBOL(__list_add_rcu);