From patchwork Sat Oct 22 07:22:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 7330 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4242:0:0:0:0:0 with SMTP id s2csp1093951wrr; Sat, 22 Oct 2022 00:58:55 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6e/ieo206EbwA2wXPT1lpZm7J8D4tf+krixmlbCI+Ihf3SPsw+5Y0EO1r/6cxgIvusE623 X-Received: by 2002:a62:7bc5:0:b0:56b:47ed:22a7 with SMTP id w188-20020a627bc5000000b0056b47ed22a7mr5127489pfc.63.1666425535194; Sat, 22 Oct 2022 00:58:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666425535; cv=none; d=google.com; s=arc-20160816; b=JBjEJtMG4zwIXB/e7oHB6+/jnRSPTagZLWC0wgzsnLOwZ91A8QjZy+K/PakV7bogLH txl7Hm4z7blZdZW4rsggVwUqIeCC+8enREPp9QAFFs1Y53GtBXPWxTHpC9J2x4vEOnhS j5U4+ZWV1fxsq6NtMcTRitFbMqAqZvxsWXak5+z4Y6r3nf/6hGoYeH4SYosVV1cxiv1z intKKudsT0Qxpe4LVQOK/fJFPzhNqyBFxHtL2Y1nhtCGzS0sZ4FWH2gCrqfVW0saqyAe t4g8ypGCcZemTpUcYEsqVSEuvAJtvWtjmxJTI3vd7O0iF3r4P15rwWxcB+4U+ZM248w1 vjhA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Nfa+HXInf3+9WrIfRzS6/6EK+owEXMGAUIzzaIB4kIM=; b=xVb1S3IUZNB8lFOgUOGqkIAdJWlnqlTSiEifS8qZC1BkpTCc50xtP2RbIOAv38b36q RvJ3JvB133b1tT1C9ivoG5oqmgPBdSjAwWrz310gogfuBPKU9RWhi3p5V/rwWUErN0rH RN5MGmAveMwc6q7ecNMu+m2fKg9LKBxCAdPn7s4bHWOwU7XQMc3wYAzQLcwMlZsnVrUs OEm0ICu2YFZfwN1Eyfd6Cv8dV44OEKfpFqkfQERw+H/szi/3X3ZyL5RzmTzRWdjDeUiS gBvdQKY6EM/yh1dKLWYjj7FHKpYD2Eh1L/P8DPHwe7QgQXpEdZZIaS9uxOp088q2/6I1 TI1w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=2EYNcA7a; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id bc9-20020a170902930900b001868827ed1esi1971915plb.131.2022.10.22.00.58.42; Sat, 22 Oct 2022 00:58:55 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=2EYNcA7a; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232366AbiJVH6Z (ORCPT + 99 others); Sat, 22 Oct 2022 03:58:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55588 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232091AbiJVHyB (ORCPT ); Sat, 22 Oct 2022 03:54:01 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 240C666F1D; Sat, 22 Oct 2022 00:47:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 690FF60B83; Sat, 22 Oct 2022 07:46:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 79804C433D6; Sat, 22 Oct 2022 07:46:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666424766; bh=dVDJSEzRrPtFqIsoE3zXwmOWCE8M6Zw0BQZP6LOW0Mw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2EYNcA7anzzEdgiI04P+Ne0DWp6/g2dM8RaLbUwUARtNtafNaEPoWLZUo9wsTYzp/ zLSTVzEoboJCDwdZMk2anc6Kt9uCkICL6CO8l2lRndLg9f4HDDhwiRDVJyEbW30I4k ir5ST+oSsjxQmMXJYZA/FfQaHDNzAu7f+avfGSLw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiaomeng Tong , Kalle Valo , Sasha Levin Subject: [PATCH 5.19 269/717] cw1200: fix incorrect check to determine if no element is found in list Date: Sat, 22 Oct 2022 09:22:28 +0200 Message-Id: <20221022072501.951140149@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747373821799878545?= X-GMAIL-MSGID: =?utf-8?q?1747373821799878545?= From: Xiaomeng Tong [ Upstream commit 86df5de5c632d3bd940f59bbb14ae912aa9cc363 ] The bug is here: "} else if (item) {". The list iterator value will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the list is empty or no element is found in list. Use a new value 'iter' as the list iterator, while use the old value 'item' as a dedicated pointer to point to the found element, which 1. can fix this bug, due to now 'item' is NULL only if it's not found. 2. do not need to change all the uses of 'item' after the loop. 3. can also limit the scope of the list iterator 'iter' *only inside* the traversal loop by simply declaring 'iter' inside the loop in the future, as usage of the iterator outside of the list_for_each_entry is considered harmful. https://lkml.org/lkml/2022/2/17/1032 Fixes: a910e4a94f692 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") Signed-off-by: Xiaomeng Tong Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220413091723.17596-1-xiam0nd.tong@gmail.com Signed-off-by: Sasha Levin --- drivers/net/wireless/st/cw1200/queue.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/net/wireless/st/cw1200/queue.c b/drivers/net/wireless/st/cw1200/queue.c index e06da4b3b0d4..805a3c1bf8fe 100644 --- a/drivers/net/wireless/st/cw1200/queue.c +++ b/drivers/net/wireless/st/cw1200/queue.c @@ -91,23 +91,25 @@ static void __cw1200_queue_gc(struct cw1200_queue *queue, bool unlock) { struct cw1200_queue_stats *stats = queue->stats; - struct cw1200_queue_item *item = NULL, *tmp; + struct cw1200_queue_item *item = NULL, *iter, *tmp; bool wakeup_stats = false; - list_for_each_entry_safe(item, tmp, &queue->queue, head) { - if (time_is_after_jiffies(item->queue_timestamp + queue->ttl)) + list_for_each_entry_safe(iter, tmp, &queue->queue, head) { + if (time_is_after_jiffies(iter->queue_timestamp + queue->ttl)) { + item = iter; break; + } --queue->num_queued; - --queue->link_map_cache[item->txpriv.link_id]; + --queue->link_map_cache[iter->txpriv.link_id]; spin_lock_bh(&stats->lock); --stats->num_queued; - if (!--stats->link_map_cache[item->txpriv.link_id]) + if (!--stats->link_map_cache[iter->txpriv.link_id]) wakeup_stats = true; spin_unlock_bh(&stats->lock); cw1200_debug_tx_ttl(stats->priv); - cw1200_queue_register_post_gc(head, item); - item->skb = NULL; - list_move_tail(&item->head, &queue->free_pool); + cw1200_queue_register_post_gc(head, iter); + iter->skb = NULL; + list_move_tail(&iter->head, &queue->free_pool); } if (wakeup_stats)