linux-kernel - [PATCH v2] ufs: fix an NULL check on list iterator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220320150733.21824-1-xiam0nd.tong@gmail.com>
Date:   Sun, 20 Mar 2022 23:07:33 +0800
From:   Xiaomeng Tong <xiam0nd.tong@...il.com>
To:     alim.akhtar@...sung.com
Cc:     avri.altman@....com, jejb@...ux.ibm.com,
        martin.petersen@...cle.com, daejun7.park@...sung.com,
        beanhuo@...ron.com, bvanassche@....org, keosung.park@...sung.com,
        gregkh@...uxfoundation.org, stanley.chu@...iatek.com,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
        jakobkoschel@...il.com, Xiaomeng Tong <xiam0nd.tong@...il.com>
Subject: [PATCH v2] ufs: fix an NULL check on list iterator

The list iterator is always non-NULL so the check 'if (!rgn)'
is always false and the dev_err() is never called. Move the
check outside the loop and determine if 'victim_rgn' is NULL,
to fix this bug.

Fixes: 4b5f49079c52a ("scsi: ufs: ufshpb: L2P map management for HPB read")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@...il.com>
---
changes since v1:
 - move the check outside the loop (Jakob Koschel)
v1: https://lore.kernel.org/all/20220319042657.21835-1-xiam0nd.tong@gmail.com/
---
 drivers/scsi/ufs/ufshpb.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/ufs/ufshpb.c b/drivers/scsi/ufs/ufshpb.c
index 2d36a0715fca..b34feba1f53d 100644
--- a/drivers/scsi/ufs/ufshpb.c
+++ b/drivers/scsi/ufs/ufshpb.c
@@ -869,12 +869,6 @@ static struct ufshpb_region *ufshpb_victim_lru_info(struct ufshpb_lu *hpb)
 	struct ufshpb_region *rgn, *victim_rgn = NULL;
 
 	list_for_each_entry(rgn, &lru_info->lh_lru_rgn, list_lru_rgn) {
-		if (!rgn) {
-			dev_err(&hpb->sdev_ufs_lu->sdev_dev,
-				"%s: no region allocated\n",
-				__func__);
-			return NULL;
-		}
 		if (ufshpb_check_srgns_issue_state(hpb, rgn))
 			continue;
 
@@ -890,6 +884,11 @@ static struct ufshpb_region *ufshpb_victim_lru_info(struct ufshpb_lu *hpb)
 		break;
 	}
 
+	if (!victim_rgn)
+		dev_err(&hpb->sdev_ufs_lu->sdev_dev,
+			"%s: no region allocated\n",
+			__func__);
+
 	return victim_rgn;
 }
 

base-commit: 14702b3b2438e2f2d07ae93b5d695c166e5c83d1
-- 
2.17.1