If &encl_mm->encl->mm_list does not contain the searched 'encl_mm', 'tmp' will not point to a valid sgx_encl_mm struct. Since the code within the guarded block is just called when the element is found, it can simply be moved into the list iterator. Within the list iterator 'tmp' is guaranteed to point to a valid element. Signed-off-by: Jakob Koschel <jkl820.git@xxxxxxxxx> --- Linus proposed to avoid any use of the list iterator variable after the loop, in the attempt to move the list iterator variable declaration into the marcro to avoid any potential misuse after the loop. Using it in a pointer comparision after the loop is undefined behavior and should be omitted if possible [1]. Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@xxxxxxxxxxxxxx/ [1] --- arch/x86/kernel/cpu/sgx/encl.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c index 2a0e90fe2abc..db585b780141 100644 --- a/arch/x86/kernel/cpu/sgx/encl.c +++ b/arch/x86/kernel/cpu/sgx/encl.c @@ -764,15 +764,13 @@ static void sgx_mmu_notifier_release(struct mmu_notifier *mn, list_for_each_entry(tmp, &encl_mm->encl->mm_list, list) { if (tmp == encl_mm) { list_del_rcu(&encl_mm->list); - break; + spin_unlock(&encl_mm->encl->mm_lock); + synchronize_srcu(&encl_mm->encl->srcu); + mmu_notifier_put(mn); + return; } } spin_unlock(&encl_mm->encl->mm_lock); - - if (tmp == encl_mm) { - synchronize_srcu(&encl_mm->encl->srcu); - mmu_notifier_put(mn); - } } static void sgx_mmu_notifier_free(struct mmu_notifier *mn) --- base-commit: d2d11f342b179f1894a901f143ec7c008caba43e change-id: 20230206-sgx-use-after-iter-f584c1d64c87 Best regards, -- Jakob Koschel <jkl820.git@xxxxxxxxx>
