This is a note to let you know that I've just added the patch titled
iommu/msm: Fix an incorrect NULL check on list iterator
to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
iommu-msm-fix-an-incorrect-null-check-on-list-iterator.patch
and it can be found in the queue-5.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 8b9ad480bd1dd25f4ff4854af5685fa334a2f57a Mon Sep 17 00:00:00 2001
From: Xiaomeng Tong <xiam0nd.tong@xxxxxxxxx>
Date: Sun, 1 May 2022 21:28:23 +0800
Subject: iommu/msm: Fix an incorrect NULL check on list iterator
From: Xiaomeng Tong <xiam0nd.tong@xxxxxxxxx>
commit 8b9ad480bd1dd25f4ff4854af5685fa334a2f57a upstream.
The bug is here:
if (!iommu || iommu->dev->of_node != spec->np) {
The list iterator value 'iommu' will *always* be set and non-NULL by
list_for_each_entry(), so it is incorrect to assume that the iterator
value will be NULL if the list is empty or no element is found (in fact,
it will point to a invalid structure object containing HEAD).
To fix the bug, use a new value 'iter' as the list iterator, while use
the old value 'iommu' as a dedicated variable to point to the found one,
and remove the unneeded check for 'iommu->dev->of_node != spec->np'
outside the loop.
Cc: stable@xxxxxxxxxxxxxxx
Fixes: f78ebca8ff3d6 ("iommu/msm: Add support for generic master bindings")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@xxxxxxxxx>
Link: https://lore.kernel.org/r/20220501132823.12714-1-xiam0nd.tong@xxxxxxxxx
Signed-off-by: Joerg Roedel <jroedel@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/iommu/msm_iommu.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/iommu/msm_iommu.c
+++ b/drivers/iommu/msm_iommu.c
@@ -636,16 +636,19 @@ static void insert_iommu_master(struct d
static int qcom_iommu_of_xlate(struct device *dev,
struct of_phandle_args *spec)
{
- struct msm_iommu_dev *iommu;
+ struct msm_iommu_dev *iommu = NULL, *iter;
unsigned long flags;
int ret = 0;
spin_lock_irqsave(&msm_iommu_lock, flags);
- list_for_each_entry(iommu, &qcom_iommu_devices, dev_node)
- if (iommu->dev->of_node == spec->np)
+ list_for_each_entry(iter, &qcom_iommu_devices, dev_node) {
+ if (iter->dev->of_node == spec->np) {
+ iommu = iter;
break;
+ }
+ }
- if (!iommu || iommu->dev->of_node != spec->np) {
+ if (!iommu) {
ret = -ENODEV;
goto fail;
}
Patches currently in stable-queue which might be from xiam0nd.tong@xxxxxxxxx are
queue-5.4/md-fix-an-incorrect-null-check-in-does_sb_need_changing.patch
queue-5.4/scsi-dc395x-fix-a-missing-check-on-list-iterator.patch
queue-5.4/iommu-msm-fix-an-incorrect-null-check-on-list-iterator.patch
queue-5.4/carl9170-tx-fix-an-incorrect-use-of-list-iterator.patch
queue-5.4/tilcdc-tilcdc_external-fix-an-incorrect-null-check-on-list-iterator.patch
queue-5.4/drm-nouveau-clk-fix-an-incorrect-null-check-on-list-iterator.patch
queue-5.4/media-uvcvideo-fix-missing-check-to-determine-if-ele.patch
queue-5.4/md-fix-an-incorrect-null-check-in-md_reload_sb.patch
