It is unsafe to assume that tmp != mdev can only evaluate to false
if the break within the list iterator is hit.
When the break is not hit, tmp is set to an address derived from the
head element. If mdev would match with that value of tmp it would allow
continuing beyond the safety check even if mdev was never found within
the list
Signed-off-by: Jakob Koschel <jakobkoschel@xxxxxxxxx>
---
drivers/vfio/mdev/mdev_core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
index b314101237fe..e646ba5036f4 100644
--- a/drivers/vfio/mdev/mdev_core.c
+++ b/drivers/vfio/mdev/mdev_core.c
@@ -339,14 +339,17 @@ int mdev_device_remove(struct mdev_device *mdev)
{
struct mdev_device *tmp;
struct mdev_parent *parent = mdev->type->parent;
+ bool found = false;
mutex_lock(&mdev_list_lock);
list_for_each_entry(tmp, &mdev_list, next) {
- if (tmp == mdev)
+ if (tmp == mdev) {
+ found = true;
break;
+ }
}
- if (tmp != mdev) {
+ if (!found) {
mutex_unlock(&mdev_list_lock);
return -ENODEV;
}
--
2.25.1
