lkml.org 
[lkml]   [2022]   [Feb]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[RFC PATCH 04/13] vfio/mdev: remove the usage of the list iterator after the loop
Date
It is unsafe to assume that tmp != mdev can only evaluate to false
if the break within the list iterator is hit.

When the break is not hit, tmp is set to an address derived from the
head element. If mdev would match with that value of tmp it would allow
continuing beyond the safety check even if mdev was never found within
the list

Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
---
drivers/vfio/mdev/mdev_core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
index b314101237fe..e646ba5036f4 100644
--- a/drivers/vfio/mdev/mdev_core.c
+++ b/drivers/vfio/mdev/mdev_core.c
@@ -339,14 +339,17 @@ int mdev_device_remove(struct mdev_device *mdev)
{
struct mdev_device *tmp;
struct mdev_parent *parent = mdev->type->parent;
+ bool found = false;

mutex_lock(&mdev_list_lock);
list_for_each_entry(tmp, &mdev_list, next) {
- if (tmp == mdev)
+ if (tmp == mdev) {
+ found = true;
break;
+ }
}

- if (tmp != mdev) {
+ if (!found) {
mutex_unlock(&mdev_list_lock);
return -ENODEV;
}
--
2.25.1
\
 
 \ /
  Last update: 2022-02-17 19:50    [W:0.143 / U:0.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site