Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Content-Type: text/plain;
        charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 15.0 \(3693.60.0.1.1\))
Subject: Re: [PATCH] saa7134: fix incorrect check to determine if no element
 is found in list
From:   Jakob Koschel <jakobkoschel@gmail.com>
In-Reply-To: <20220320025718.10053-1-xiam0nd.tong@gmail.com>
Date:   Sun, 20 Mar 2022 07:12:33 +0100
Cc:     mchehab@kernel.org, hverkuil-cisco@xs4all.nl,
        yangyingliang@huawei.com, akpm@osdl.org, v4l@cerqueira.org,
        linux-media@vger.kernel.org, linux-kernel@vger.kernel.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <86AD565C-ADD2-4000-BF99-487EF9FCDB2F@gmail.com>
References: <20220320025718.10053-1-xiam0nd.tong@gmail.com>
To:     Xiaomeng Tong <xiam0nd.tong@gmail.com>
Precedence: bulk


> On 20. Mar 2022, at 03:57, Xiaomeng Tong <xiam0nd.tong@gmail.com> =
wrote:
>=20
> The bug is here: "if (dev =3D=3D NULL)".
>=20
> The list iterator value will *always* be set and non-NULL by
> list_for_each_entry(), so it is incorrect to assume that the iterator
> value will be NULL if the list is empty or no element is found in =
list.
>=20
> Use a new value 'iter' as the list iterator, while use the old value
> 'req' as a dedicated pointer to point to the found element, which
> 1. can fix this bug, due to now 'req' is NULL only if it's not found.
> 2. do not need to change all the uses of 'req' after the loop.
> 3. can also limit the scope of the list iterator 'iter' *only inside*
>   the traversal loop by simply declaring 'iter' inside the loop in the
>   future, as usage of the iterator outside of the list_for_each_entry
>   is considered harmful. https://lkml.org/lkml/2022/2/17/1032
>=20
> Fixes: 4aabf6331f89c ("[PATCH] v4l: (951) Make saa7134-oss as a =
stand-alone module")
> Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
> ---
> drivers/media/pci/saa7134/saa7134-alsa.c | 11 +++++++----
> 1 file changed, 7 insertions(+), 4 deletions(-)
>=20
> diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c =
b/drivers/media/pci/saa7134/saa7134-alsa.c
> index fb24d2ed3621..4955f7e7c5bf 100644
> --- a/drivers/media/pci/saa7134/saa7134-alsa.c
> +++ b/drivers/media/pci/saa7134/saa7134-alsa.c
> @@ -1215,18 +1215,21 @@ static int alsa_device_exit(struct saa7134_dev =
*dev)
> static int saa7134_alsa_init(void)
> {
> 	struct saa7134_dev *dev =3D NULL;
> +	struct saa7134_dev *iter;
>=20
> 	saa7134_dmasound_init =3D alsa_device_init;
> 	saa7134_dmasound_exit =3D alsa_device_exit;
>=20
> 	pr_info("saa7134 ALSA driver for DMA sound loaded\n");
>=20
> -	list_for_each_entry(dev, &saa7134_devlist, devlist) {
> -		if (dev->pci->device =3D=3D =
PCI_DEVICE_ID_PHILIPS_SAA7130)
> +	list_for_each_entry(iter, &saa7134_devlist, devlist) {
> +		dev =3D iter;
> +
> +		if (iter->pci->device =3D=3D =
PCI_DEVICE_ID_PHILIPS_SAA7130)
> 			pr_info("%s/alsa: %s doesn't support digital =
audio\n",
> -				dev->name, =
saa7134_boards[dev->board].name);
> +				iter->name, =
saa7134_boards[iter->board].name);
> 		else
> -			alsa_device_init(dev);
> +			alsa_device_init(iter);
> 	}
>=20
> 	if (dev =3D=3D NULL)

I could be wrong, but judging from the printed message "saa7134 ALSA: no =
saa7134 cards found"
and how the code is structured, I got the impression that the intention =
for this code was
to only execute if the list is empty.=20

There is no break or anything so it's not looking for a specific =
element.

It might make more sense to simply replace this check with:
	if (list_empty(&saa7134_devlist))

> --=20
> 2.17.1
>=20

	Jakob