Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Jakob Koschel <jakobkoschel@gmail.com>
To:     Fei Li <fei1.li@intel.com>
Cc:     Jakob Koschel <jakobkoschel@gmail.com>,
        linux-kernel@vger.kernel.org, Mike Rapoport <rppt@kernel.org>,
        "Brian Johannesmeyer" <bjohannesmeyer@gmail.com>,
        Cristiano Giuffrida <c.giuffrida@vu.nl>,
        "Bos, H.J." <h.j.bos@vu.nl>
Subject: [PATCH] virt: acrn: fix invalid check past list iterator
Date:   Sat, 19 Mar 2022 21:38:19 +0100
Message-Id: <20220319203819.2559993-1-jakobkoschel@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

The condition retry == 0 is theoretically possible even if 'client'
does not point to a valid element because no break was hit.

To only execute the dev_warn if actually a break within the loop was
hit, a separate variable is used that is only set if it is ensured to
point to a valid client struct.

Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
---
 drivers/virt/acrn/ioreq.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/virt/acrn/ioreq.c b/drivers/virt/acrn/ioreq.c
index 5ff1c53740c0..bdf7cedce926 100644
--- a/drivers/virt/acrn/ioreq.c
+++ b/drivers/virt/acrn/ioreq.c
@@ -211,7 +211,7 @@ static int ioreq_task(void *data)
  */
 void acrn_ioreq_request_clear(struct acrn_vm *vm)
 {
-	struct acrn_ioreq_client *client;
+	struct acrn_ioreq_client *client, *iter;
 	bool has_pending = false;
 	unsigned long vcpu;
 	int retry = 10;
@@ -228,17 +228,20 @@ void acrn_ioreq_request_clear(struct acrn_vm *vm)
 	 */
 	do {
 		spin_lock_bh(&vm->ioreq_clients_lock);
-		list_for_each_entry(client, &vm->ioreq_clients, list) {
-			has_pending = has_pending_request(client);
-			if (has_pending)
+		client = NULL;
+		list_for_each_entry(iter, &vm->ioreq_clients, list) {
+			has_pending = has_pending_request(iter);
+			if (has_pending) {
+				client = iter;
 				break;
+			}
 		}
 		spin_unlock_bh(&vm->ioreq_clients_lock);

 		if (has_pending)
 			schedule_timeout_interruptible(HZ / 100);
 	} while (has_pending && --retry > 0);
-	if (retry == 0)
+	if (client)
 		dev_warn(acrn_dev.this_device,
 			 "%s cannot flush pending request!\n", client->name);


base-commit: 34e047aa16c0123bbae8e2f6df33e5ecc1f56601
--
2.25.1