Messages in this thread | | | Date | Wed, 23 Feb 2022 15:12:22 -0400 | From | Jason Gunthorpe <> | Subject | Re: [RFC PATCH 04/13] vfio/mdev: remove the usage of the list iterator after the loop |
| |
On Wed, Feb 23, 2022 at 11:06:03AM -0800, Linus Torvalds wrote:
> And as such, you not only can't dereference it, but you also shouldn't > even compare pointer values - because the pointer arithmetic that was > valid for loop entries is not valid for the HEAD entry that is > embedded in another type. So the pointer arithmetic might have turned > it into a pointer outside the real container of the HEAD, and might > actually match something else.
Yes, this is what I had put together as well about this patch, and I think it is OK as-is. In this case the list head is in the .bss of a module so I don't think it is very likely that the type confused container_of() will alias a kalloc result, but it is certainly technically wrong as-is.
> So elsewhere I suggested that the fix to "you can't use the pointer > outside the loop" be made to literally disallow it (using C99 for-loop > variables seems the cleanest model), and have the compiler refuse to > touch code that tries to use the loop iterator outside.
Oh yes, that would be really nice solution.
Jason
| |