Commit c10187b1 authored by Alexander Usyskin's avatar Alexander Usyskin Committed by Greg Kroah-Hartman
Browse files

mei: avoid iterator usage outside of list_for_each_entry 

Usage of the iterator outside of the list_for_each_entry
is considered harmful. https://lkml.org/lkml/2022/2/17/1032



Do not reference the loop variable outside of the loop,
by rearranging the orders of execution.
Instead of performing search loop and checking outside the loop
if the end of the list was hit and no matching element was found,
the execution is performed inside the loop upon a successful match
followed by a goto statement to the next step,
therefore no condition has to be performed after the loop has ended.

Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAlexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20220308095926.300412-1-tomas.winkler@intel.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7bbbd084

drivers/misc/mei/interrupt.c

+15 −20
Original line number Diff line number Diff line
@@ -424,12 +424,12 @@ int mei_irq_read_handler(struct mei_device *dev, 
	list_for_each_entry(cl, &dev->file_list, link) {

		if (mei_cl_hbm_equal(cl, mei_hdr)) {

			cl_dbg(dev, cl, "got a message\n");

			break;

			ret = mei_cl_irq_read_msg(cl, mei_hdr, meta_hdr, cmpl_list);

			goto reset_slots;

		}

	}



	/* if no recipient cl was found we assume corrupted header */

	if (&cl->link == &dev->file_list) {

	/* A message for not connected fixed address clients

	 * should be silently discarded

	 * On power down client may be force cleaned,
@@ -441,14 +441,9 @@ int mei_irq_read_handler(struct mei_device *dev, 
		ret = 0;

		goto reset_slots;

	}

		dev_err(dev->dev, "no destination client found 0x%08X\n",

				dev->rd_msg_hdr[0]);

	dev_err(dev->dev, "no destination client found 0x%08X\n", dev->rd_msg_hdr[0]);

	ret = -EBADMSG;

	goto end;

	}



	ret = mei_cl_irq_read_msg(cl, mei_hdr, meta_hdr, cmpl_list);





reset_slots:

	/* reset the number of slots and header */