Patch "scsi: lpfc: Avoid usage of list iterator variable after loop" has been added to the 6.2-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    scsi: lpfc: Avoid usage of list iterator variable after loop

to the 6.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     scsi-lpfc-avoid-usage-of-list-iterator-variable-afte.patch
and it can be found in the queue-6.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3c2ef8be1f93c7db6b3340e89cde3566739a8cf3
Author: Jakob Koschel <jkl820.git@xxxxxxxxx>
Date:   Wed Mar 1 18:19:14 2023 +0100

    scsi: lpfc: Avoid usage of list iterator variable after loop
    
    [ Upstream commit 2850b23e9f9ae3696e472d2883ea1b43aafa884e ]
    
    If the &epd_pool->list is empty when executing
    lpfc_get_io_buf_from_expedite_pool() the function would return an invalid
    pointer. Even in the case if the list is guaranteed to be populated, the
    iterator variable should not be used after the loop to be more robust for
    future changes.
    
    Linus proposed to avoid any use of the list iterator variable after the
    loop, in the attempt to move the list iterator variable declaration into
    the macro to avoid any potential misuse after the loop [1].
    
    Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@xxxxxxxxxxxxxx/ [1]
    Signed-off-by: Jakob Koschel <jkl820.git@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20230301-scsi-lpfc-avoid-list-iterator-after-loop-v1-1-325578ae7561@xxxxxxxxx
    Reviewed-by: Justin Tee <justin.tee@xxxxxxxxxxxx>
    Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 3aa7206537de7..c0ddf55676a1f 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -21903,20 +21903,20 @@ lpfc_get_io_buf_from_private_pool(struct lpfc_hba *phba,
 static struct lpfc_io_buf *
 lpfc_get_io_buf_from_expedite_pool(struct lpfc_hba *phba)
 {
-	struct lpfc_io_buf *lpfc_ncmd;
+	struct lpfc_io_buf *lpfc_ncmd = NULL, *iter;
 	struct lpfc_io_buf *lpfc_ncmd_next;
 	unsigned long iflag;
 	struct lpfc_epd_pool *epd_pool;
 
 	epd_pool = &phba->epd_pool;
-	lpfc_ncmd = NULL;
 
 	spin_lock_irqsave(&epd_pool->lock, iflag);
 	if (epd_pool->count > 0) {
-		list_for_each_entry_safe(lpfc_ncmd, lpfc_ncmd_next,
+		list_for_each_entry_safe(iter, lpfc_ncmd_next,
 					 &epd_pool->list, list) {
-			list_del(&lpfc_ncmd->list);
+			list_del(&iter->list);
 			epd_pool->count--;
+			lpfc_ncmd = iter;
 			break;
 		}
 	}