Commit eb6dc99e authored by Jakob Koschel's avatar Jakob Koschel Committed by Greg Kroah-Hartman
Browse files

usb: gadget: composite: remove check of list iterator against head past the loop body 

When list_for_each_entry() completes the iteration over the whole list
without breaking the loop, the iterator value will be a bogus pointer
computed based on the head element.

While it is safe to use the pointer to determine if it was computed
based on the head element, either with list_entry_is_head() or
&pos->member == head, using the iterator variable after the loop should
be avoided.

In preparation to limiting the scope of a list iterator to the list
traversal loop, use a dedicated pointer to point to the found element [1].

Link: https://lore.kernel.org/all/YhdfEIwI4EdtHdym@kroah.com/


Signed-off-by: default avatarJakob Koschel <jakobkoschel@gmail.com>
Link: https://lore.kernel.org/r/20220308171818.384491-22-jakobkoschel@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 41894774

drivers/usb/gadget/composite.c

+5 −4
Original line number Diff line number Diff line
@@ -1690,6 +1690,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 
	u16				w_value = le16_to_cpu(ctrl->wValue);

	u16				w_length = le16_to_cpu(ctrl->wLength);

	struct usb_function		*f = NULL;

	struct usb_function		*iter;

	u8				endp;



	if (w_length > USB_COMP_EP0_BUFSIZ) {
@@ -2046,12 +2047,12 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 
			if (!cdev->config)

				break;

			endp = ((w_index & 0x80) >> 3) | (w_index & 0x0f);

			list_for_each_entry(f, &cdev->config->functions, list) {

				if (test_bit(endp, f->endpoints))

			list_for_each_entry(iter, &cdev->config->functions, list) {

				if (test_bit(endp, iter->endpoints)) {

					f = iter;

					break;

				}

			if (&f->list == &cdev->config->functions)

				f = NULL;

			}

			break;

		}

try_fun_setup: