Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2fefc625 authored by Jakob Koschel's avatar Jakob Koschel Committed by Greg Kroah-Hartman
Browse files

firewire: remove check of list iterator against head past the loop body 

commit 9423973869bd4632ffe669f950510c49296656e0 upstream.

When list_for_each_entry() completes the iteration over the whole list
without breaking the loop, the iterator value will be a bogus pointer
computed based on the head element.

While it is safe to use the pointer to determine if it was computed
based on the head element, either with list_entry_is_head() or
&pos->member == head, using the iterator variable after the loop should
be avoided.

In preparation to limit the scope of a list iterator to the list
traversal loop, use a dedicated pointer to point to the found element [1].

Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/

 [1]
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarJakob Koschel <jakobkoschel@gmail.com>
Signed-off-by: default avatarTakashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20220409041243.603210-3-o-takashi@sakamocchi.jp


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 34b9b918

drivers/firewire/core-transaction.c

+16 −14
Original line number Diff line number Diff line
@@ -73,24 +73,25 @@ static int try_cancel_split_timeout(struct fw_transaction *t) 
static int close_transaction(struct fw_transaction *transaction,

			     struct fw_card *card, int rcode)

{

	struct fw_transaction *t;

	struct fw_transaction *t = NULL, *iter;

	unsigned long flags;



	spin_lock_irqsave(&card->lock, flags);

	list_for_each_entry(t, &card->transaction_list, link) {

		if (t == transaction) {

			if (!try_cancel_split_timeout(t)) {

	list_for_each_entry(iter, &card->transaction_list, link) {

		if (iter == transaction) {

			if (!try_cancel_split_timeout(iter)) {

				spin_unlock_irqrestore(&card->lock, flags);

				goto timed_out;

			}

			list_del_init(&t->link);

			card->tlabel_mask &= ~(1ULL << t->tlabel);

			list_del_init(&iter->link);

			card->tlabel_mask &= ~(1ULL << iter->tlabel);

			t = iter;

			break;

		}

	}

	spin_unlock_irqrestore(&card->lock, flags);



	if (&t->link != &card->transaction_list) {

	if (t) {

		t->callback(card, rcode, NULL, 0, t->callback_data);

		return 0;

	}
@@ -935,7 +936,7 @@ EXPORT_SYMBOL(fw_core_handle_request); 


void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)

{

	struct fw_transaction *t;

	struct fw_transaction *t = NULL, *iter;

	unsigned long flags;

	u32 *data;

	size_t data_length;
@@ -947,20 +948,21 @@ void fw_core_handle_response(struct fw_card *card, struct fw_packet *p) 
	rcode	= HEADER_GET_RCODE(p->header[1]);



	spin_lock_irqsave(&card->lock, flags);

	list_for_each_entry(t, &card->transaction_list, link) {

		if (t->node_id == source && t->tlabel == tlabel) {

			if (!try_cancel_split_timeout(t)) {

	list_for_each_entry(iter, &card->transaction_list, link) {

		if (iter->node_id == source && iter->tlabel == tlabel) {

			if (!try_cancel_split_timeout(iter)) {

				spin_unlock_irqrestore(&card->lock, flags);

				goto timed_out;

			}

			list_del_init(&t->link);

			card->tlabel_mask &= ~(1ULL << t->tlabel);

			list_del_init(&iter->link);

			card->tlabel_mask &= ~(1ULL << iter->tlabel);

			t = iter;

			break;

		}

	}

	spin_unlock_irqrestore(&card->lock, flags);



	if (&t->link == &card->transaction_list) {

	if (!t) {

 timed_out:

		fw_notice(card, "unsolicited response (source %x, tlabel %x)\n",

			  source, tlabel);

drivers/firewire/sbp2.c

+7 −6
Original line number Diff line number Diff line
@@ -408,7 +408,7 @@ static void sbp2_status_write(struct fw_card *card, struct fw_request *request, 
			      void *payload, size_t length, void *callback_data)

{

	struct sbp2_logical_unit *lu = callback_data;

	struct sbp2_orb *orb;

	struct sbp2_orb *orb = NULL, *iter;

	struct sbp2_status status;

	unsigned long flags;
@@ -433,17 +433,18 @@ static void sbp2_status_write(struct fw_card *card, struct fw_request *request, 


	/* Lookup the orb corresponding to this status write. */

	spin_lock_irqsave(&lu->tgt->lock, flags);

	list_for_each_entry(orb, &lu->orb_list, link) {

	list_for_each_entry(iter, &lu->orb_list, link) {

		if (STATUS_GET_ORB_HIGH(status) == 0 &&

		    STATUS_GET_ORB_LOW(status) == orb->request_bus) {

			orb->rcode = RCODE_COMPLETE;

			list_del(&orb->link);

		    STATUS_GET_ORB_LOW(status) == iter->request_bus) {

			iter->rcode = RCODE_COMPLETE;

			list_del(&iter->link);

			orb = iter;

			break;

		}

	}

	spin_unlock_irqrestore(&lu->tgt->lock, flags);



	if (&orb->link != &lu->orb_list) {

	if (orb) {

		orb->callback(orb, &status);

		kref_put(&orb->kref, free_orb); /* orb callback reference */

	} else {