drivers: occ: Fix bad list access
PATCH 1/1 drivers: occ: Fix bad list access
From: "Edward A. James" <[email protected]>
list_first_entry() doesn't return NULL if the list is empty...
--- drivers/fsi/occ.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/fsi/occ.c +1 -1
@@ -572,7 +572,7 @@ static void occ_worker(struct work_struct *work) again:spin_lock_irq (&occ->list_lock); - xfr = list_first_entry(&occ->xfrs, struct occ_xfr, link); + xfr = list_first_entry_or_null(&occ->xfrs, struct occ_xfr, link);if (!xfr) {spin_unlock_irq (&occ->list_lock);return ;
Signature · 1 line
1.8.3.1
Quoted 3 lines · Eddie James
list_first_entry()doesn't return NULL if the list is empty...Signed-off-by Edward A. James <[email protected]>
Quoted 14 lines
---
drivers/fsi/occ.c| 2 +-1 file changed, 1 insertion(+), 1 deletion(-)drivers/fsi/occ.c +0
-0@@ -572,7 +572,7 @@ static void occ_worker(struct work_struct *work)again:
spin_lock_irq(&occ->list_lock);drivers/fsi/occ.c +1
-1- xfr = list_first_entry(&occ->xfrs, struct occ_xfr, link); + xfr = list_first_entry_or_null(&occ->xfrs, struct occ_xfr, link);
Quoted 3 lines
if (!xfr) {
spin_unlock_irq(&occ->list_lock);
return;Its a bit unusual that the entry is left on the list while the work is being performed, requiring the list lock to be acquired at the end. But I don't see anything wrong with the locking and mutexes (assuming that lockdep would have complained about client lock nesting inside occ lock).
Without this fix, if there is an underflow the data around the list head will be interpreted as a workqueue request.
milton
Andrew Jeffery
AppliedQuoted 5 lines · Eddie James
Quoted 1 line
From: "Edward A. James" <[email protected]>
list_first_entry()doesn't return NULL if the list is empty...Signed-off-by Edward A. James <[email protected]>
Thanks, applied to dev-4.10.
Andrew
Quoted 17 lines
---
drivers/fsi/occ.c | 2 +-1 file changed, 1 insertion(+), 1 deletion(-)drivers/fsi/occ.c +0
-0@@ -572,7 +572,7 @@ static void occ_worker(struct work_struct *work)again:
Quoted 1 line
spin_lock_irq(&occ->list_lock);Quoted 5 lines
drivers/fsi/occ.c +1
-1- xfr = list_first_entry(&occ->xfrs, struct occ_xfr, link); + xfr = list_first_entry_or_null(&occ->xfrs, struct occ_xfr, link);if (!xfr) {
spin_unlock_irq(&occ->list_lock);
return;