iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

misc: fastrpc: fix an incorrect NULL check on list iterator

Browse Source 
The bug is here:
	if (!buf) {

The list iterator value 'buf' will *always* be set and non-NULL
by list_for_each_entry(), so it is incorrect to assume that the
iterator value will be NULL if the list is empty (in this case, the
check 'if (!buf) {' will always be false and never exit expectly).

To fix the bug, use a new variable 'iter' as the list iterator,
while use the original variable 'buf' as a dedicated pointer to
point to the found element.

Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Link: https://lore.kernel.org/r/20220327062202.5720-1-xiam0nd.tong@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Xiaomeng Tong 2022-03-27 14:22:02 +08:00 committed by Greg Kroah-Hartman
parent 4834f9898c
commit 5ac11fe03a
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/misc/fastrpc.c
View File

@ -1606,17 +1606,18 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl,
struct fastrpc_req_munmap *req) struct fastrpc_req_munmap *req)
{ {
struct fastrpc_invoke_args args[1] = { [0] = { 0 } }; struct fastrpc_invoke_args args[1] = { [0] = { 0 } };
struct fastrpc_buf *buf, *b; struct fastrpc_buf *buf = NULL, *iter, *b;
struct fastrpc_munmap_req_msg req_msg; struct fastrpc_munmap_req_msg req_msg;
struct device *dev = fl->sctx->dev; struct device *dev = fl->sctx->dev;
int err; int err;
u32 sc; u32 sc;
spin_lock(&fl->lock); spin_lock(&fl->lock);
list_for_each_entry_safe(buf, b, &fl->mmaps, node) { list_for_each_entry_safe(iter, b, &fl->mmaps, node) {
if ((buf->raddr == req->vaddrout) && (buf->size == req->size)) if ((iter->raddr == req->vaddrout) && (iter->size == req->size)) {
buf = iter;
break; break;
buf = NULL; }
} }
spin_unlock(&fl->lock); spin_unlock(&fl->lock);