iommu/msm: Fix an incorrect NULL check on list iterator

The bug is here:
	if (!iommu || iommu->dev->of_node != spec->np) {

The list iterator value 'iommu' will *always* be set and non-NULL by
list_for_each_entry(), so it is incorrect to assume that the iterator
value will be NULL if the list is empty or no element is found (in fact,
it will point to a invalid structure object containing HEAD).

To fix the bug, use a new value 'iter' as the list iterator, while use
the old value 'iommu' as a dedicated variable to point to the found one,
and remove the unneeded check for 'iommu->dev->of_node != spec->np'
outside the loop.

Cc: stable@vger.kernel.org
Fixes: f78ebca8ff3d6 ("iommu/msm: Add support for generic master bindings")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Link: https://lore.kernel.org/r/20220501132823.12714-1-xiam0nd.tong@gmail.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>

diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c
index 3d9bd20437382415b0d30058c44cd053eedf4b3a..f09aedfdd462bd15c414bf8e85857c56780c30a4 100644 (file)
--- a/drivers/iommu/msm_iommu.c
+++ b/drivers/iommu/msm_iommu.c
@@ -615,16 +615,19 @@ static int insert_iommu_master(struct device *dev,
 static int qcom_iommu_of_xlate(struct device *dev,
                               struct of_phandle_args *spec)
 {
-       struct msm_iommu_dev *iommu;
+       struct msm_iommu_dev *iommu = NULL, *iter;
        unsigned long flags;
        int ret = 0;
 
        spin_lock_irqsave(&msm_iommu_lock, flags);
-       list_for_each_entry(iommu, &qcom_iommu_devices, dev_node)
-               if (iommu->dev->of_node == spec->np)
+       list_for_each_entry(iter, &qcom_iommu_devices, dev_node) {
+               if (iter->dev->of_node == spec->np) {
+                       iommu = iter;
                        break;
+               }
+       }
 
-       if (!iommu || iommu->dev->of_node != spec->np) {
+       if (!iommu) {
                ret = -ENODEV;
                goto fail;
        }