| Message ID | 20220320035436.11293-1-xiam0nd.tong@gmail.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [v2] cw1200: fix incorrect check to determine if no element is found in list | expand |
Xiaomeng Tong <xiam0nd.tong@gmail.com> wrote: > The bug is here: "} else if (item) {". > > The list iterator value will *always* be set and non-NULL by > list_for_each_entry(), so it is incorrect to assume that the iterator > value will be NULL if the list is empty or no element is found in list. > > Use a new value 'iter' as the list iterator, while use the old value > 'item' as a dedicated pointer to point to the found element, which > 1. can fix this bug, due to now 'item' is NULL only if it's not found. > 2. do not need to change all the uses of 'item' after the loop. > 3. can also limit the scope of the list iterator 'iter' *only inside* > the traversal loop by simply declaring 'iter' inside the loop in the > future, as usage of the iterator outside of the list_for_each_entry > is considered harmful. https://lkml.org/lkml/2022/2/17/1032 > > Fixes: a910e4a94f692 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") > Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com> Can someone review this, please?
On 4/6/2022 4:32 AM, Kalle Valo wrote: > Xiaomeng Tong <xiam0nd.tong@gmail.com> wrote: > >> The bug is here: "} else if (item) {". >> >> The list iterator value will *always* be set and non-NULL by >> list_for_each_entry(), so it is incorrect to assume that the iterator >> value will be NULL if the list is empty or no element is found in list. >> >> Use a new value 'iter' as the list iterator, while use the old value >> 'item' as a dedicated pointer to point to the found element, which >> 1. can fix this bug, due to now 'item' is NULL only if it's not found. >> 2. do not need to change all the uses of 'item' after the loop. >> 3. can also limit the scope of the list iterator 'iter' *only inside* >> the traversal loop by simply declaring 'iter' inside the loop in the >> future, as usage of the iterator outside of the list_for_each_entry >> is considered harmful. https://lkml.org/lkml/2022/2/17/1032 >> >> Fixes: a910e4a94f692 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") >> Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com> > > Can someone review this, please? > Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Xiaomeng Tong <xiam0nd.tong@gmail.com> wrote: > The bug is here: "} else if (item) {". > > The list iterator value will *always* be set and non-NULL by > list_for_each_entry(), so it is incorrect to assume that the iterator > value will be NULL if the list is empty or no element is found in list. > > Use a new value 'iter' as the list iterator, while use the old value > 'item' as a dedicated pointer to point to the found element, which > 1. can fix this bug, due to now 'item' is NULL only if it's not found. > 2. do not need to change all the uses of 'item' after the loop. > 3. can also limit the scope of the list iterator 'iter' *only inside* > the traversal loop by simply declaring 'iter' inside the loop in the > future, as usage of the iterator outside of the list_for_each_entry > is considered harmful. https://lkml.org/lkml/2022/2/17/1032 > > Fixes: a910e4a94f692 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") > Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com> > Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com> Failed to apply, please rebase on top of latest wireless-next. Recorded preimage for 'drivers/net/wireless/st/cw1200/queue.c' error: Failed to merge in the changes. hint: Use 'git am --show-current-patch=diff' to see the failed patch Applying: cw1200: fix incorrect check to determine if no element is found in list Using index info to reconstruct a base tree... M drivers/net/wireless/st/cw1200/queue.c Falling back to patching base and 3-way merge... Auto-merging drivers/net/wireless/st/cw1200/queue.c CONFLICT (content): Merge conflict in drivers/net/wireless/st/cw1200/queue.c Patch failed at 0001 cw1200: fix incorrect check to determine if no element is found in list Patch set to Changes Requested.
On Tue, 12 Apr 2022 13:51:21 +0000, Kalle Valo wrote:
> Failed to apply, please rebase on top of latest wireless-next.
I have sent a PATCH v3 rebased on latest wireless-next as you suggested, please check it.
Thank you very much.
--
Xiaomeng Tong
diff --git a/drivers/net/wireless/st/cw1200/queue.c b/drivers/net/wireless/st/cw1200/queue.c index 12952b1c29df..d8dd4fac4ef1 100644 --- a/drivers/net/wireless/st/cw1200/queue.c +++ b/drivers/net/wireless/st/cw1200/queue.c @@ -90,23 +90,25 @@ static void __cw1200_queue_gc(struct cw1200_queue *queue, bool unlock) { struct cw1200_queue_stats *stats = queue->stats; - struct cw1200_queue_item *item = NULL, *tmp; + struct cw1200_queue_item *item = NULL, *iter, *tmp; bool wakeup_stats = false; - list_for_each_entry_safe(item, tmp, &queue->queue, head) { - if (jiffies - item->queue_timestamp < queue->ttl) + list_for_each_entry_safe(iter, tmp, &queue->queue, head) { + if (jiffies - iter->queue_timestamp < queue->ttl) { + item = iter; break; + } --queue->num_queued; - --queue->link_map_cache[item->txpriv.link_id]; + --queue->link_map_cache[iter->txpriv.link_id]; spin_lock_bh(&stats->lock); --stats->num_queued; - if (!--stats->link_map_cache[item->txpriv.link_id]) + if (!--stats->link_map_cache[iter->txpriv.link_id]) wakeup_stats = true; spin_unlock_bh(&stats->lock); cw1200_debug_tx_ttl(stats->priv); - cw1200_queue_register_post_gc(head, item); - item->skb = NULL; - list_move_tail(&item->head, &queue->free_pool); + cw1200_queue_register_post_gc(head, iter); + iter->skb = NULL; + list_move_tail(&iter->head, &queue->free_pool); } if (wakeup_stats)
The bug is here: "} else if (item) {". The list iterator value will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the list is empty or no element is found in list. Use a new value 'iter' as the list iterator, while use the old value 'item' as a dedicated pointer to point to the found element, which 1. can fix this bug, due to now 'item' is NULL only if it's not found. 2. do not need to change all the uses of 'item' after the loop. 3. can also limit the scope of the list iterator 'iter' *only inside* the traversal loop by simply declaring 'iter' inside the loop in the future, as usage of the iterator outside of the list_for_each_entry is considered harmful. https://lkml.org/lkml/2022/2/17/1032 Fixes: a910e4a94f692 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com> --- changes since v1: - fix incorrect check to item (Jakob Koschel) v1: https://lore.kernel.org/all/20220319063800.28791-1-xiam0nd.tong@gmail.com/ --- drivers/net/wireless/st/cw1200/queue.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)