Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Date:   Mon, 6 Jun 2022 16:06:26 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Jared Kangas <kangas.jd@gmail.com>
Cc:     vaibhav.sr@gmail.com, mgreer@animalcreek.com, elder@kernel.org,
        gregkh@linuxfoundation.org, greybus-dev@lists.linaro.org,
        johan@kernel.org, linux-kernel@vger.kernel.org,
        linux-staging@lists.linux.dev
Subject: Re: [PATCH] staging: greybus: audio: fix loop cursor use after
 iteration
Message-ID: <20220606130626.GX2146@kadam>
References: <20220605231806.720085-1-kangas.jd@gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220605231806.720085-1-kangas.jd@gmail.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?SBUYx3MEpYc0orCOMmui1tOt7lGxEP2GYUQpJqKO3rt7jLy4Zh1B8Frl452k?=
 =?us-ascii?Q?y8BUBXY6VeENaGnaNp+1JHT1QyPI6xo5LFOFbmreLVRywFmZWo5/j+mlz90n?=
 =?us-ascii?Q?GGntMC9x+SGSjPqt2iU7DL5yXQ2z66QTLYz58qD8L1TFoqe661saTN/UvlOx?=
 =?us-ascii?Q?zYs0tN3VivuCvFfIoU/CWEzVTDe8IUaA/Y42RmHB4r22yZiAh8wC8YPmVOSS?=
 =?us-ascii?Q?Ki2KwGTp3Uw1ZNR8F9X/fzj2tDwR1hqK8j2dmmg3XrOw4sBRi0NrH+kOiIt/?=
 =?us-ascii?Q?4Hviw/jZm5Cv8x2cZ3qft4JHw5tni3/7HKEU+nuZFd92GU4rhg5+eCXT6DEN?=
 =?us-ascii?Q?XVU6o7pTxYYpmOjHZd7Yy/tw/VJlbXI3I6Tlv1Tt/jWkL6exAtnGac1mif+W?=
 =?us-ascii?Q?jgwx/UlwYpGN1dY5DjohZV6a6vI6D+aIAvWsPjBjDxqdZB2OI/sJom0AXpHQ?=
 =?us-ascii?Q?Iip7QI2DOrIQQMka8mfVXKCLFryLKSTyqKhnBeFCowPkgwBBf+DMXORZVRYy?=
 =?us-ascii?Q?S+nKTP1gACXtq4QZfgrmnFyYAKri/kyPHJcFlQqAXccM22+UBTj2bcaG2azK?=
 =?us-ascii?Q?Rt9Py9/Ua5HSRxeXKl/ZLxzTN2CDo/RKC8eNQiabaoNhl1CC4jFhoCQnzm2S?=
 =?us-ascii?Q?BJ70M6OWwM28VhvjyhKxfVadRnIgeK/eHgYGvG6/z759WjAqfIKFziWKMPb3?=
 =?us-ascii?Q?ctXvlk1ClGv/UhrfIohFaWjxeIjDHKP9K73zfGqykIJOGnW7+WEIzU0tAy3w?=
 =?us-ascii?Q?3nW7SEsK4H2TSYZA+Ts5hKmMOMImKzL8ap1D1335G3vDnMW3UcKgNNSCHAag?=
 =?us-ascii?Q?zxqkZQnXNoI2ZYDXTppZVbcd04+vOASYuEzp0Vn0JK6hnVEBRnvuCaZk8PvK?=
 =?us-ascii?Q?WABKL6KDeGCPIx4yy2PgzGMxfK9A3/jucLeEcXQIAPJFd8uTuypOKUAFlSLm?=
 =?us-ascii?Q?wXmmipPjoadnPOzwr2gB728HXsjV05CjqfIiWX/KFOqbJbMWBPLSiriECg50?=
 =?us-ascii?Q?22u0Od9dKimO4wBkQ3ONnrWPvtqKON6NXqjnedP/qfYaUbIj/4+67p49SsIn?=
 =?us-ascii?Q?OQsA50B79Z1TrRlN3oQyfHBi3Mb0hAiiRtOQLCCEnOaxhTTtg5rlDbkWP5dd?=
 =?us-ascii?Q?l2ODaNtgo1wmIuI4G+JYqp18BEoLg71opVnAvuWYlMmVru8IEpxquq9IMx7B?=
 =?us-ascii?Q?/UB1GErgwCFDmU7/YeTA8QJ5XA1C9+hR2WGPl1j6Cce+QbdZR/DUk3sJoPWw?=
 =?us-ascii?Q?tVAV0+k8SzRjeEOoweMgk1ju/TTcIXfJktLrtuxR2m6rxtdBr/FsQeJLDv2w?=
 =?us-ascii?Q?tUuvy45K2cIC6VdXoUZ2vaSxqtkreB3g+e+K91yi5pn0pr7qzDvPL095lgmc?=
 =?us-ascii?Q?hnrDbNA8uEfz7p6ugryrhynvRFXEXM3xDl1UwORBLEcRoY+o+feNv9B2odFf?=
 =?us-ascii?Q?ovWyktBNDMrdznz/fXSTusbdg27DyPTBsLnqhus5J/XKDVwraPTubppP1n7+?=
 =?us-ascii?Q?43MkyVCP5CoD7MfuO30uTeE5VCxX9vZh3DCK47Wizt/gQSsHyF9sxbZ1OQ4d?=
 =?us-ascii?Q?lqd8mIIHflgcVfGVFI/dkN+RX82eQzA3juFLEVLSxfHgm2Vr2ZnUUang4Ap+?=
 =?us-ascii?Q?eCzGL4W+ibbRnbdV10KeZ4FSaEn/GU4m4WHsJik0krSup2dX/Kd5iZTVnDy0?=
 =?us-ascii?Q?WemE5bhJKjYzlknimsv50i0JgbiqJfKwvKAN9tE9LPtp/Wm21WVJ2Zhj13Mq?=
 =?us-ascii?Q?WAaLI/d8OB1K3FUIKek/rgejFtgmGz0=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1c2acea5-ec06-4fef-5c87-08da47bd681d
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Jun 2022 13:06:45.1710
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: WGR7C+apgRf0rwbbMp+Kqr5y3v1lhPm6kANDhgxgGUEaIjx46bOV4uZcDitTOmLDh5ClggsjFD49LV38P5Lsr/mcc4KjJUkKaiOtTfbRFNQ=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR10MB4161
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517,18.0.874
 definitions=2022-06-06_04:2022-06-02,2022-06-06 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=744 spamscore=0
 adultscore=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2204290000 definitions=main-2206060060
X-Proofpoint-GUID: B05ZPBcFPjZmrChMFSF0a6OEIbUCL-YK
X-Proofpoint-ORIG-GUID: B05ZPBcFPjZmrChMFSF0a6OEIbUCL-YK
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE
	autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sun, Jun 05, 2022 at 04:18:06PM -0700, Jared Kangas wrote:
> gbaudio_dapm_free_controls() iterates over widgets using
> list_for_each_entry_safe(), which leaves the loop cursor pointing to a
> meaningless structure if it completes a traversal of the list. The
> cursor was set to NULL at the end of the loop body, but would be
> overwritten by the final loop cursor update.
> 
> Because of this behavior, the widget could be non-null after the loop
> even if the widget wasn't found, and the cleanup logic would treat the
> pointer as a valid widget to free.
> 
> To fix this, introduce a temporary variable to act as the loop cursor
> and copy it to a variable that can be accessed after the loop finishes.
> 
> This was detected with the help of Coccinelle.
> 

This needs a Fixes tag.

Fixes: 510e340efe0c ("staging: greybus: audio: Add helper APIs for dynamic audio modules")

Otherwise, looks good!

Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>

regards,
dan carpenter