staging: rtl8188eu: use safe iterator in rtw_free_network_queue

This is another case where we may remove list entries while we iterate over the list. Use list_for_each_safe to avoid an endless loop.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
Without this patch, unloading the module goes into an endless loop sometimes.

 drivers/staging/rtl8188eu/core/rtw_sta_mgt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/staging/rtl8188eu/core/rtw_sta_mgt.c +2 -2

index 7941ca0397ed..eda7a441acde 100644
@@ -379,7 +379,7 @@ u32 rtw_free_stainfo(struct adapter *padapter, struct sta_info *psta)
 /*  free all stainfo which in sta_hash[all] */
 void rtw_free_all_stainfo(struct adapter *padapter)
 {
-	struct list_head *plist, *phead;
+	struct list_head *plist, *phead, *temp;
 	s32 index;
 	struct sta_info *psta = NULL;
 	struct sta_priv *pstapriv = &padapter->stapriv;

@@ -392,7 +392,7 @@ void rtw_free_all_stainfo(struct adapter *padapter)
 
 	for (index = 0; index < NUM_STA; index++) {
 		phead = &pstapriv->sta_hash[index];
-		list_for_each(plist, phead) {
+		list_for_each_safe(plist, temp, phead) {
 			psta = list_entry(plist, struct sta_info, hash_list);
 
 			if (pbcmc_stainfo != psta)

Signature · 1 line

2.20.1

In the first loop in expire_timeout_chk, we may call rtw_free_stainfo and remove an entry from auth_list.

In the second loop, we may call list_del_init on our list.

Use list_for_each_safe for both loops.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
compile-tested only

 drivers/staging/rtl8188eu/core/rtw_ap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/staging/rtl8188eu/core/rtw_ap.c +2 -2

index ca9a321c4921..a410b42ecb6e 100644
@@ -164,7 +164,7 @@ static u8 chk_sta_is_alive(struct sta_info *psta)
 
 void expire_timeout_chk(struct adapter *padapter)
 {
-	struct list_head *phead, *plist;
+	struct list_head *phead, *plist, *temp;
 	u8 updated = 0;
 	struct sta_info *psta = NULL;
 	struct sta_priv *pstapriv = &padapter->stapriv;

@@ -176,7 +176,7 @@ void expire_timeout_chk(struct adapter *padapter)
 
 	phead = &pstapriv->auth_list;
 	/* check auth_queue */
-	list_for_each(plist, phead) {
+	list_for_each_safe(plist, temp, phead) {
 		psta = list_entry(plist, struct sta_info, auth_list);
 
 		if (psta->expire_to > 0) {

Signature · 1 line

2.20.1

Use list_for_each_safe, we may delete list items while iterating over the list.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
compile-tested only

 drivers/staging/rtl8188eu/core/rtw_ap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/staging/rtl8188eu/core/rtw_ap.c +2 -2

index a410b42ecb6e..601974df4114 100644
@@ -1072,7 +1072,7 @@ int rtw_acl_add_sta(struct adapter *padapter, u8 *addr)
 
 int rtw_acl_remove_sta(struct adapter *padapter, u8 *addr)
 {
-	struct list_head *plist, *phead;
+	struct list_head *plist, *phead, *temp;
 	struct rtw_wlan_acl_node *paclnode;
 	struct sta_priv *pstapriv = &padapter->stapriv;
 	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;

@@ -1083,7 +1083,7 @@ int rtw_acl_remove_sta(struct adapter *padapter, u8 *addr)
 	spin_lock_bh(&pacl_node_q->lock);
 
 	phead = get_list_head(pacl_node_q);
-	list_for_each(plist, phead) {
+	list_for_each_safe(plist, temp, phead) {
 		paclnode = list_entry(plist, struct rtw_wlan_acl_node, list);
 
 		if (!memcmp(paclnode->addr, addr, ETH_ALEN)) {

Signature · 1 line

2.20.1

Use list_for_each_safe, we may delete list items while iterating over the list.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
compile-tested only

 drivers/staging/rtl8188eu/core/rtw_ap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/staging/rtl8188eu/core/rtw_ap.c +2 -2

index 601974df4114..8ffafc7eb316 100644
@@ -1579,7 +1579,7 @@ u8 ap_free_sta(struct adapter *padapter, struct sta_info *psta,
 
 int rtw_sta_flush(struct adapter *padapter)
 {
-	struct list_head *phead, *plist;
+	struct list_head *phead, *plist, *temp;
 	struct sta_info *psta = NULL;
 	struct sta_priv *pstapriv = &padapter->stapriv;
 	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

@@ -1594,7 +1594,7 @@ int rtw_sta_flush(struct adapter *padapter)
 	spin_lock_bh(&pstapriv->asoc_list_lock);
 	phead = &pstapriv->asoc_list;
 	/* free sta asoc_queue */
-	list_for_each(plist, phead) {
+	list_for_each_safe(plist, temp, phead) {
 		psta = list_entry(plist, struct sta_info, asoc_list);
 
 		list_del_init(&psta->asoc_list);

Signature · 1 line

2.20.1

Use list_for_each_safe, we may delete list items while iterating over the list.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
compile-tested only

 drivers/staging/rtl8188eu/core/rtw_xmit.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/staging/rtl8188eu/core/rtw_xmit.c +2 -2

index 3763d188b892..62b8f178280e 100644
@@ -1329,13 +1329,13 @@ s32 rtw_free_xmitframe(struct xmit_priv *pxmitpriv, struct xmit_frame *pxmitfram
 
 void rtw_free_xmitframe_queue(struct xmit_priv *pxmitpriv, struct __queue *pframequeue)
 {
-	struct list_head *plist, *phead;
+	struct list_head *plist, *phead, *temp;
 	struct	xmit_frame	*pxmitframe;
 
 	spin_lock_bh(&pframequeue->lock);
 
 	phead = get_list_head(pframequeue);
-	list_for_each(plist, phead) {
+	list_for_each_safe(plist, temp, phead) {
 		pxmitframe = list_entry(plist, struct xmit_frame, list);
 
 		rtw_free_xmitframe(pxmitpriv, pxmitframe);

Signature · 1 line

2.20.1

rtw_free_network_queue iterates over the scanned wireless networks and calls _rtw_free_network for each of them. In some cases, _rtw_free_network removes a network from the list.

We have to use list_for_each_safe if we remove list entries while we iterate over a list.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
Without this patch, it's easy to get the driver into an endless loop by scanning, connecting and disconnecting repeatedly.

wpa_supplicant -B -Dwext -i wlan0 -c /path/to/my/config... while true ; do
sleep 1
wpa_cli reconfigure
wpa_cli add_network
wpa_cli set_network 0 ssid ...
wpa_cli set_network 0 psk ...
wpa_cli select_network 0
sleep 6
wpa_cli status
wpa_cli disconnect 0
done

 drivers/staging/rtl8188eu/core/rtw_mlme.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/staging/rtl8188eu/core/rtw_mlme.c +2 -2

index 159465b073c2..14816ad51668 100644
@@ -199,7 +199,7 @@ struct wlan_network *rtw_find_network(struct __queue *scanned_queue, u8 *addr)
 
 void rtw_free_network_queue(struct adapter *padapter, u8 isfreeall)
 {
-	struct list_head *phead, *plist;
+	struct list_head *phead, *plist, *temp;
 	struct wlan_network *pnetwork;
 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 	struct __queue *scanned_queue = &pmlmepriv->scanned_queue;

@@ -207,7 +207,7 @@ void rtw_free_network_queue(struct adapter *padapter, u8 isfreeall)
 	spin_lock_bh(&scanned_queue->lock);
 
 	phead = get_list_head(scanned_queue);
-	list_for_each(plist, phead) {
+	list_for_each_safe(plist, temp, phead) {
 		pnetwork = list_entry(plist, struct wlan_network, list);
 
 		_rtw_free_network(pmlmepriv, pnetwork, isfreeall);

Signature · 1 line

2.20.1

rtw_free_network_queue iterates over the scanned wireless networks and calls _rtw_free_network for each of them. In some cases, _rtw_free_network removes a network from the list.

We have to use list_for_each_safe if we remove list entries while we iterate over a list.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
Without this patch, it's easy to get the driver into an endless loop by scanning, connecting and disconnecting repeatedly.

wpa_supplicant -B -Dwext -i wlan0 -c /path/to/my/config... while true ; do
sleep 1
wpa_cli reconfigure
wpa_cli add_network
wpa_cli set_network 0 ssid ...
wpa_cli set_network 0 psk ...
wpa_cli select_network 0
sleep 6
wpa_cli status
wpa_cli disconnect 0
done

  drivers/staging/rtl8188eu/core/rtw_mlme.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

drivers/staging/rtl8188eu/core/rtw_mlme.c +1 -1

index 159465b073c2..14816ad51668 100644
@@ -199,7 +199,7 @@ struct wlan_network *rtw_find_network(struct __queue *scanned_queue, u8 *addr)
 
  void rtw_free_network_queue(struct adapter *padapter, u8 isfreeall)
  {
-	struct list_head *phead, *plist;
+	struct list_head *phead, *plist, *temp;
  	struct wlan_network *pnetwork;
  	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
  	struct __queue *scanned_queue = &pmlmepriv->scanned_queue;

Le 16/05/2021 à 18:06, Martin Kaiser a écrit :

Quoted 42 lines

rtw_free_network_queue iterates over the scanned wireless networks and calls _rtw_free_network for each of them. In some cases, _rtw_free_network removes a network from the list.

We have to use list_for_each_safe if we remove list entries while we iterate over a list.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
Without this patch, it's easy to get the driver into an endless loop by scanning, connecting and disconnecting repeatedly.

wpa_supplicant -B -Dwext -i wlan0 -c /path/to/my/config... while true ; do
sleep 1
wpa_cli reconfigure
wpa_cli add_network
wpa_cli set_network 0 ssid ...
wpa_cli set_network 0 psk ...
wpa_cli select_network 0
sleep 6
wpa_cli status
wpa_cli disconnect 0
done

  drivers/staging/rtl8188eu/core/rtw_mlme.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

drivers/staging/rtl8188eu/core/rtw_mlme.c +1 -1

index 159465b073c2..14816ad51668 100644
@@ -199,7 +199,7 @@ struct wlan_network *rtw_find_network(struct __queue *scanned_queue, u8 *addr)
  void rtw_free_network_queue(struct adapter *padapter, u8 isfreeall)
  {
-	struct list_head *phead, *plist;
+	struct list_head *phead, *plist, *temp;
  	struct wlan_network *pnetwork;
  	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
  	struct __queue *scanned_queue = &pmlmepriv->scanned_queue;

@@ -207,7 +207,7 @@ void rtw_free_network_queue(struct adapter *padapter, u8 isfreeall)

drivers/staging/rtl8188eu/core/rtw_mlme.c void rtw_free_network_queue(struct adapter *padapter, u8 isfreeall) · line 213

Quoted 6 lines

drivers/staging/rtl8188eu/core/rtw_mlme.c +1 -1

  	spin_lock_bh(&scanned_queue->lock);
  	phead = get_list_head(scanned_queue);
-	list_for_each(plist, phead) {
+	list_for_each_safe(plist, temp, phead) {
  		pnetwork = list_entry(plist, struct wlan_network, list);
  		_rtw_free_network(pmlmepriv, pnetwork, isfreeall);

Nitpicking: 'list_for_each_entry_safe' could also be used to simplify code.

Thanks for catching these... I've created a new Smatch static checker warning for this but it only works for list_for_each_entry(). Eventually someone would have run the coccinelle script to convert these list_for_each loops into list_for_each_entry(). Otherwise you have to parse container_of() and I've been meaning to do that for a while but I haven't yet.

Anyway, I'm going to test it out overnight and see what it finds. It's sort a new use for the modification_hook(), before I had only ever used it to silence warnings but this check uses it to trigger warnings. So perhaps it will generate a lot of false positives. We'll see.

It sets the state of the iterator to &start at the start of the loop and if it's not &start state at the end then it prints a warning.

regards,
dan carpenter

Quoted 15 lines · Dan Carpenter

Thanks for catching these... I've created a new Smatch static checker warning for this but it only works for list_for_each_entry(). Eventually someone would have run the coccinelle script to convert these list_for_each loops into list_for_each_entry(). Otherwise you have to parse container_of() and I've been meaning to do that for a while but I haven't yet.

Anyway, I'm going to test it out overnight and see what it finds. It's sort a new use for the modification_hook(), before I had only ever used it to silence warnings but this check uses it to trigger warnings. So perhaps it will generate a lot of false positives. We'll see.

It sets the state of the iterator to &start at the start of the loop and if it's not &start state at the end then it prints a warning.

Quoted 3 lines

regards,
dan carpenter

That Smatch check didn't work at all. :P Back to the drawing board.

regards,
dan carpenter

The __w1_remove_master_device() function calls:

	list_del(&dev->w1_master_entry);

So presumably this can cause an endless loop.

[...]

Hello Daniel Jurgens,

The patch 32f69e4be269: "{net, IB}/mlx5: Manage port association for multiport RoCE" from Jan 4, 2018, leads to the following static checker warning:

	drivers/infiniband/hw/mlx5/main.c:3285 mlx5_ib_init_multiport_master()
	warn: iterator 'mpi->list.next' changed during iteration

drivers/infiniband/hw/mlx5/main.c
3285 list_for_each_entry(mpi, &mlx5_ib_unaffiliated_port_list,

                                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

We're iterating through the unafiliated list.

  3286                                      list) {
  3287                          if (dev->sys_image_guid == mpi->sys_image_guid &&
  3288                              (mlx5_core_native_port_num(mpi->mdev) - 1) == i) {
  3289                                  bound = mlx5_ib_bind_slave_port(dev, mpi);

The mlx5_ib_bind_slave_port() function returns true on success and false on failure. On the failure path it calls:

	mlx5_ib_unbind_slave_port(ibdev, mpi);

Which adds our "mpi" as the last item on the unaffiliated list. I don't think anything good can come from adding a list item to a list twice.

  3290                          }
  3291  
  3292                          if (bound) {
  3293                                  dev_dbg(mpi->mdev->device,
  3294                                          "removing port from unaffiliated list.\n");
  3295                                  mlx5_ib_dbg(dev, "port %d bound\n", i + 1);
  3296                                  list_del(&mpi->list);
  3297                                  break;
  3298                          }
  3299                  }
  3300                  if (!bound)
  3301                          mlx5_ib_dbg(dev, "no free port found for port %d\n",
  3302                                      i + 1);

regards,
dan carpenter

If sas_notify_lldd_dev_found() fails then this code calls:

	sas_unregister_dev(port, dev);

which removes "dev", our list iterator, from the list. This could lead to an endless loop. We need to use list_for_each_entry_safe().

Fixes 303694eeee5e ("[SCSI] libsas: suspend / resume support")

Signed-off-by Dan Carpenter<[email protected]>

If sas_notify_lldd_dev_found() fails then this code calls:

	sas_unregister_dev(port, dev);

which removes "dev", our list iterator, from the list. This could lead to an endless loop. We need to use list_for_each_entry_safe().

This is another case where we may remove list entries while we iterate over the list. Use list_for_each_entry_safe to avoid an endless loop.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
v2:
- use list_for_each_entry_safe

Without this patch, unloading the module goes into an endless loop sometimes.

 drivers/staging/rtl8188eu/core/rtw_sta_mgt.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

drivers/staging/rtl8188eu/core/rtw_sta_mgt.c +3 -5

index 7941ca0397ed..5af7af5f5a5a 100644
@@ -379,9 +379,9 @@ u32 rtw_free_stainfo(struct adapter *padapter, struct sta_info *psta)
 /*  free all stainfo which in sta_hash[all] */
 void rtw_free_all_stainfo(struct adapter *padapter)
 {
-	struct list_head *plist, *phead;
+	struct list_head *phead;
 	s32 index;
-	struct sta_info *psta = NULL;
+	struct sta_info *psta, *temp;
 	struct sta_priv *pstapriv = &padapter->stapriv;
 	struct sta_info *pbcmc_stainfo = rtw_get_bcmc_stainfo(padapter);
 

@@ -392,9 +392,7 @@ void rtw_free_all_stainfo(struct adapter *padapter)
 
 	for (index = 0; index < NUM_STA; index++) {
 		phead = &pstapriv->sta_hash[index];
-		list_for_each(plist, phead) {
-			psta = list_entry(plist, struct sta_info, hash_list);
-
+		list_for_each_entry_safe(psta, temp, phead, hash_list) {
 			if (pbcmc_stainfo != psta)
 				rtw_free_stainfo(padapter, psta);
 		}

Signature · 1 line

2.20.1

In the first loop in expire_timeout_chk, we may call rtw_free_stainfo and remove an entry from auth_list.

In the second loop, we may call list_del_init on our list.

Use list_for_each_entry_safe for both loops.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
v2:
- use list_for_each_entry_safe
- update both loops (I forgot the 2nd loop in v1)

 drivers/staging/rtl8188eu/core/rtw_ap.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

drivers/staging/rtl8188eu/core/rtw_ap.c +4 -8

index ca9a321c4921..6d7c96f1aa42 100644
@@ -164,9 +164,9 @@ static u8 chk_sta_is_alive(struct sta_info *psta)
 
 void expire_timeout_chk(struct adapter *padapter)
 {
-	struct list_head *phead, *plist;
+	struct list_head *phead;
 	u8 updated = 0;
-	struct sta_info *psta = NULL;
+	struct sta_info *psta, *temp;
 	struct sta_priv *pstapriv = &padapter->stapriv;
 	u8 chk_alive_num = 0;
 	char chk_alive_list[NUM_STA];

@@ -176,9 +176,7 @@ void expire_timeout_chk(struct adapter *padapter)
 
 	phead = &pstapriv->auth_list;
 	/* check auth_queue */
-	list_for_each(plist, phead) {
-		psta = list_entry(plist, struct sta_info, auth_list);
-
+	list_for_each_entry_safe(psta, temp, phead, auth_list) {
 		if (psta->expire_to > 0) {
 			psta->expire_to--;
 			if (psta->expire_to == 0) {

@@ -206,9 +204,7 @@ void expire_timeout_chk(struct adapter *padapter)
 
 	phead = &pstapriv->asoc_list;
 	/* check asoc_queue */
-	list_for_each(plist, phead) {
-		psta = list_entry(plist, struct sta_info, asoc_list);
-
+	list_for_each_entry_safe(psta, temp, phead, asoc_list) {
 		if (chk_sta_is_alive(psta) || !psta->expire_to) {
 			psta->expire_to = pstapriv->expire_to;
 			psta->keep_alive_trycnt = 0;

Signature · 1 line

2.20.1

Use list_for_each_entry_safe, we may delete list items while iterating over the list.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
v2:
- use list_for_each_entry_safe

 drivers/staging/rtl8188eu/core/rtw_ap.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

drivers/staging/rtl8188eu/core/rtw_ap.c +3 -5

index 6d7c96f1aa42..d297d5301153 100644
@@ -1068,8 +1068,8 @@ int rtw_acl_add_sta(struct adapter *padapter, u8 *addr)
 
 int rtw_acl_remove_sta(struct adapter *padapter, u8 *addr)
 {
-	struct list_head *plist, *phead;
-	struct rtw_wlan_acl_node *paclnode;
+	struct list_head *phead;
+	struct rtw_wlan_acl_node *paclnode, *temp;
 	struct sta_priv *pstapriv = &padapter->stapriv;
 	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
 	struct __queue *pacl_node_q = &pacl_list->acl_node_q;

@@ -1079,9 +1079,7 @@ int rtw_acl_remove_sta(struct adapter *padapter, u8 *addr)
 	spin_lock_bh(&pacl_node_q->lock);
 
 	phead = get_list_head(pacl_node_q);
-	list_for_each(plist, phead) {
-		paclnode = list_entry(plist, struct rtw_wlan_acl_node, list);
-
+	list_for_each_entry_safe(paclnode, temp, phead, list) {
 		if (!memcmp(paclnode->addr, addr, ETH_ALEN)) {
 			if (paclnode->valid) {
 				paclnode->valid = false;

Signature · 1 line

2.20.1

Use list_for_each_entry_safe, we may delete list items while iterating over the list.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
v2:
- use list_for_each_entry_safe

 drivers/staging/rtl8188eu/core/rtw_ap.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

drivers/staging/rtl8188eu/core/rtw_ap.c +3 -5

index d297d5301153..bbecb07274f6 100644
@@ -1573,8 +1573,8 @@ u8 ap_free_sta(struct adapter *padapter, struct sta_info *psta,
 
 int rtw_sta_flush(struct adapter *padapter)
 {
-	struct list_head *phead, *plist;
-	struct sta_info *psta = NULL;
+	struct list_head *phead;
+	struct sta_info *psta, *temp;
 	struct sta_priv *pstapriv = &padapter->stapriv;
 	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 	struct mlme_ext_info	*pmlmeinfo = &pmlmeext->mlmext_info;

@@ -1588,9 +1588,7 @@ int rtw_sta_flush(struct adapter *padapter)
 	spin_lock_bh(&pstapriv->asoc_list_lock);
 	phead = &pstapriv->asoc_list;
 	/* free sta asoc_queue */
-	list_for_each(plist, phead) {
-		psta = list_entry(plist, struct sta_info, asoc_list);
-
+	list_for_each_entry_safe(psta, temp, phead, asoc_list) {
 		list_del_init(&psta->asoc_list);
 		pstapriv->asoc_list_cnt--;
 

Signature · 1 line

2.20.1

Use list_for_each_entry_safe, we may delete list items while iterating over the list.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
v2:
- use list_for_each_entry_safe

 drivers/staging/rtl8188eu/core/rtw_xmit.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

drivers/staging/rtl8188eu/core/rtw_xmit.c +4 -6

index 3763d188b892..dcc29a74612d 100644
@@ -1329,17 +1329,15 @@ s32 rtw_free_xmitframe(struct xmit_priv *pxmitpriv, struct xmit_frame *pxmitfram
 
 void rtw_free_xmitframe_queue(struct xmit_priv *pxmitpriv, struct __queue *pframequeue)
 {
-	struct list_head *plist, *phead;
-	struct	xmit_frame	*pxmitframe;
+	struct list_head *phead;
+	struct	xmit_frame	*pxmitframe, *temp;
 
 	spin_lock_bh(&pframequeue->lock);
 
 	phead = get_list_head(pframequeue);
-	list_for_each(plist, phead) {
-		pxmitframe = list_entry(plist, struct xmit_frame, list);
-
+	list_for_each_entry_safe(pxmitframe, temp, phead, list)
 		rtw_free_xmitframe(pxmitpriv, pxmitframe);
-	}
+
 	spin_unlock_bh(&pframequeue->lock);
 }
 

Signature · 1 line

2.20.1

rtw_free_network_queue iterates over the scanned wireless networks and calls _rtw_free_network for each of them. In some cases, _rtw_free_network removes a network from the list.

We have to use list_for_each_entry_safe if we remove list entries while we iterate over a list.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
v2:
- use list_for_each_entry_safe

Without this patch, it's easy to get the driver into an endless loop by scanning, connecting and disconnecting repeatedly.

wpa_supplicant -B -Dwext -i wlan0 -c /path/to/my/config... while true ; do
sleep 1
wpa_cli reconfigure
wpa_cli add_network
wpa_cli set_network 0 ssid ...
wpa_cli set_network 0 psk ...
wpa_cli select_network 0
sleep 6
wpa_cli status
wpa_cli disconnect 0
done

 drivers/staging/rtl8188eu/core/rtw_mlme.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

drivers/staging/rtl8188eu/core/rtw_mlme.c +4 -6

index 159465b073c2..ba73ac5325e2 100644
@@ -199,19 +199,17 @@ struct wlan_network *rtw_find_network(struct __queue *scanned_queue, u8 *addr)
 
 void rtw_free_network_queue(struct adapter *padapter, u8 isfreeall)
 {
-	struct list_head *phead, *plist;
-	struct wlan_network *pnetwork;
+	struct list_head *phead;
+	struct wlan_network *pnetwork, *temp;
 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 	struct __queue *scanned_queue = &pmlmepriv->scanned_queue;
 
 	spin_lock_bh(&scanned_queue->lock);
 
 	phead = get_list_head(scanned_queue);
-	list_for_each(plist, phead) {
-		pnetwork = list_entry(plist, struct wlan_network, list);
-
+	list_for_each_entry_safe(pnetwork, temp, phead, list)
 		_rtw_free_network(pmlmepriv, pnetwork, isfreeall);
-	}
+
 	spin_unlock_bh(&scanned_queue->lock);
 }
 

Signature · 1 line

2.20.1

rtw_free_network_queue iterates over the scanned wireless networks and calls _rtw_free_network for each of them. In some cases, _rtw_free_network removes a network from the list.

We have to use list_for_each_entry_safe if we remove list entries while we iterate over a list.

Fixes 23017c8842d2 ("staging: rtl8188eu: Use list iterators and helpers")

Signed-off-by Martin Kaiser <[email protected]>

---
v2:
- use list_for_each_entry_safe