Messages in this thread Patch in this message | | | From | Jakob Koschel <> | Subject | [RFC PATCH 04/13] vfio/mdev: remove the usage of the list iterator after the loop | Date | Thu, 17 Feb 2022 19:48:20 +0100 |
| |
It is unsafe to assume that tmp != mdev can only evaluate to false if the break within the list iterator is hit.
When the break is not hit, tmp is set to an address derived from the head element. If mdev would match with that value of tmp it would allow continuing beyond the safety check even if mdev was never found within the list
Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com> --- drivers/vfio/mdev/mdev_core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c index b314101237fe..e646ba5036f4 100644 --- a/drivers/vfio/mdev/mdev_core.c +++ b/drivers/vfio/mdev/mdev_core.c @@ -339,14 +339,17 @@ int mdev_device_remove(struct mdev_device *mdev) { struct mdev_device *tmp; struct mdev_parent *parent = mdev->type->parent; + bool found = false; mutex_lock(&mdev_list_lock); list_for_each_entry(tmp, &mdev_list, next) { - if (tmp == mdev) + if (tmp == mdev) { + found = true; break; + } } - if (tmp != mdev) { + if (!found) { mutex_unlock(&mdev_list_lock); return -ENODEV; } -- 2.25.1
| |