分类： 2011-04-06 14:28 434人阅读 (0) 收藏

内核链表使用--删除链表节点

当我们使用遍历的方法来删除链表时：

list_for_each(pos, &student_list)

{

list_del(pos);

}

list_for_each(pos, head)这个宏定义是用来遍历链表的，通过其第一个参数pos来删除链表节点，但是，运行后就会出现以下错误：

Unable to handle kernel paging request at virtual address 00100100

pgd = c3aa8000

[00100100] *pgd=33a82031, *pte=00000000, *ppte=00000000

Internal error: Oops: 17 [#1]

last sysfs file: /sys/devices/virtual/vc/vcsa4/dev

Modules linked in: mylist(-) [last unloaded: mylist]

CPU: 0 Not tainted (2.6.32.2 #1)

PC is at cleanup_module+0x48/0x64 [mylist]

LR is at sys_delete_module+0x1e8/0x25c

pc : [<bf012048>] lr : [<c00603cc>] psr: 00000013

sp : c3a99f40 ip : bf0122e0 fp : 00000000

r10: be825e88 r9 : c3a98000 r8 : c002e024

r7 : c3a99f44 r6 : 00000880 r5 : bf01219c r4 : 00000000

r3 : bf0122e4 r2 : bf0122e4 r1 : 00100100 r0 : c3a480d8

Flags: nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user

Control: c000717f Table: 33aa8000 DAC: 00000015

Process rmmod (pid: 849, stack limit = 0xc3a98270)

Stack: (0xc3a99f40 to 0xc3a9a000)

9f40: c3ab8c80 696c796d 00007473 00000000 00000000 c35d8828 00000062 c0091bf8

9f60: 00000000 00000000 00000000 c3ab8c80 00000000 c3a9a6c0 c3ab8c80 00000000

9f80: bf01219c 00000880 c3a99f8c 00000000 c3ab8c80 be825f63 00000001 00000000

9fa0: 00000081 c002dea0 be825f63 00000001 be825f63 00000880 4022a024 00000001

9fc0: be825f63 00000001 00000000 00000081 00000001 00000000 be825e88 00000000

9fe0: 00000000 be825b10 00018250 401c886c 60000010 be825f63 00000000 00000000

[<bf012048>] (cleanup_module+0x48/0x64 [mylist]) from [<c00603cc>] (sys_delete_module+0x1e8/0x25c)

[<c00603cc>] (sys_delete_module+0x1e8/0x25c) from [<c002dea0>] (ret_fast_syscall+0x0/0x28)

Code: e59fc018 e1a0300c e4931004 e1510003 (e5910000)

---[ end trace 2e1cdf07b6db8d2d ]---

Segmentation fault

原因在于使用list_for_each(pos, head)来遍历整个链表时，依赖于pos->next，从他的代码实现就可以看出来：

/*include/linux/list.h*/

#define list_for_each(pos, head) /

for (pos = (head)->next; prefetch(pos->next), pos != (head); /

pos = pos->next)

而删除节点函数

list_del(pos);

会把pos的后向链表post->next指向另外一个地址，见函数原型：

/*include/linux/list.h*/

static inline void list_del(struct list_head *entry)

{

__list_del(entry->prev, entry->next);

entry->next = LIST_POISON1;

entry->prev = LIST_POISON2;

}

/*include/linux/Poison.h*/

#define LIST_POISON1 ((void *) 0x00100100)

而这个地址正好是出错信息提示的地址0x00100100。

正确的做法其实应该使用另外一个遍历宏定义：

/*include/linux/list.h*/

#define list_for_each_safe(pos, n, head) /

for (pos = (head)->next, n = pos->next; pos != (head); /

pos = n, n = pos->next)

这里用n做了pos的备份，当处理完for循环里的事情后，又把n的值重新赋回给pos，确保pos结构里的值不被改变。

JJDeng@SCUT

jjdeng.scut@gmail.com

2011.01.19

该贴来源于http://blog.ednchina.com/supertramp/1977039