ptrlist: reading deleted items in NEXT_PTR_LIST()

PATCH New Dan Carpenter 1 participant 1 message Jul 23, 2015 Sparse checker

Share & tools

Dan Carpenter

author

2015-07-23 08:24 UTC #0 lore raw

PATCH 1/1 ptrlist: reading deleted items in NEXT_PTR_LIST()

If you call DELETE_CURRENT_PTR(), then you can sometimes end up with a __list->nr that is zero. The FOR_EACH_PTR() macro can handle this but the NEXT_PTR_LIST() macro returns ptr = 0xf0f0f0f0 which leads to a segfault.

Signed-off-by Dan Carpenter <[email protected]>

---
 ptrlist.h | 2 ++
 1 file changed, 2 insertions(+)

ptrlist.h +2 -0

index 58d3bda..61e159f 100644
@@ -97,6 +97,8 @@ static inline void *last_ptr_list(struct ptr_list *list)
 			} else {							\
 				__list = __list->next;					\
 				ptr = NULL;						\
+				while (__list->nr == 0 && __list != __head)		\
+					__list = __list->next;				\
 				if (__list != __head) {					\
 					__nr = 0;					\
 					ptr = PTR_ENTRY(__list,0);			\

Signature · 1 line

2.1.4