lkml.org 
[lkml]   [2022]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 024/298] misc: fastrpc: fix an incorrect NULL check on list iterator
    Date
    From: Xiaomeng Tong <xiam0nd.tong@gmail.com>

    [ Upstream commit 5ac11fe03a0a83042d1a040dbce4fa2fb5521e23 ]

    The bug is here:
    if (!buf) {

    The list iterator value 'buf' will *always* be set and non-NULL
    by list_for_each_entry(), so it is incorrect to assume that the
    iterator value will be NULL if the list is empty (in this case, the
    check 'if (!buf) {' will always be false and never exit expectly).

    To fix the bug, use a new variable 'iter' as the list iterator,
    while use the original variable 'buf' as a dedicated pointer to
    point to the found element.

    Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support")
    Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
    Link: https://lore.kernel.org/r/20220327062202.5720-1-xiam0nd.tong@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/misc/fastrpc.c | 9 +++++----
    1 file changed, 5 insertions(+), 4 deletions(-)

    diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
    index aa1682b94a23..45aaf54a7560 100644
    --- a/drivers/misc/fastrpc.c
    +++ b/drivers/misc/fastrpc.c
    @@ -1353,17 +1353,18 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl,
    struct fastrpc_req_munmap *req)
    {
    struct fastrpc_invoke_args args[1] = { [0] = { 0 } };
    - struct fastrpc_buf *buf, *b;
    + struct fastrpc_buf *buf = NULL, *iter, *b;
    struct fastrpc_munmap_req_msg req_msg;
    struct device *dev = fl->sctx->dev;
    int err;
    u32 sc;

    spin_lock(&fl->lock);
    - list_for_each_entry_safe(buf, b, &fl->mmaps, node) {
    - if ((buf->raddr == req->vaddrout) && (buf->size == req->size))
    + list_for_each_entry_safe(iter, b, &fl->mmaps, node) {
    + if ((iter->raddr == req->vaddrout) && (iter->size == req->size)) {
    + buf = iter;
    break;
    - buf = NULL;
    + }
    }
    spin_unlock(&fl->lock);

    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-13 16:17    [W:2.587 / U:0.224 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site