[PATCH] staging: vme_user: avoid iterator variable access outside list loop

[PATCH] staging: vme_user: avoid iterator variable access outside list loop

[Riccardo Oliva]

In vme_slave_request(), vme_master_request(), vme_dma_request(), and
vme_lm_request(), the list iterators (slave_image, master_image,
dma_ctrlr, and lm) are accessed in the err_alloc error paths after
exiting the list_for_each_entry() loops.

While the iterator variable retains its pointer value upon hitting a
break, accessing list iterators outside the loop body violates modern
kernel coding standards.

Fix this by referencing the dedicated allocated resource pointers
(allocated_image, allocated_ctrlr, allocated_lm) in the error cleanup
blocks instead.

Signed-off-by: Riccardo Oliva <oliva.scorza@gmail.com>
---
Hi! This is my first patch to the kernel. I am learning the submission 
workflow. Any feedback is very much appreciated. Thanks!

 drivers/staging/vme_user/vme.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/drivers/staging/vme_user/vme.c b/drivers/staging/vme_user/vme.c
index b5c66b66c..d38c792eb 100644
--- a/drivers/staging/vme_user/vme.c
+++ b/drivers/staging/vme_user/vme.c
@@ -298,9 +298,9 @@ struct vme_resource *vme_slave_request(struct vme_dev *vdev, u32 address,
 
 err_alloc:
 	/* Unlock image */
-	mutex_lock(&slave_image->mtx);
-	slave_image->locked = 0;
-	mutex_unlock(&slave_image->mtx);
+	mutex_lock(&allocated_image->mtx);
+	allocated_image->locked = 0;
+	mutex_unlock(&allocated_image->mtx);
 err_image:
 err_bus:
 	return NULL;
@@ -495,9 +495,9 @@ struct vme_resource *vme_master_request(struct vme_dev *vdev, u32 address,
 
 err_alloc:
 	/* Unlock image */
-	spin_lock(&master_image->lock);
-	master_image->locked = 0;
-	spin_unlock(&master_image->lock);
+	spin_lock(&allocated_image->lock);
+	allocated_image->locked = 0;
+	spin_unlock(&allocated_image->lock);
 err_image:
 err_bus:
 	return NULL;
@@ -865,9 +865,9 @@ struct vme_resource *vme_dma_request(struct vme_dev *vdev, u32 route)
 
 err_alloc:
 	/* Unlock image */
-	mutex_lock(&dma_ctrlr->mtx);
-	dma_ctrlr->locked = 0;
-	mutex_unlock(&dma_ctrlr->mtx);
+	mutex_lock(&allocated_ctrlr->mtx);
+	allocated_ctrlr->locked = 0;
+	mutex_unlock(&allocated_ctrlr->mtx);
 err_ctrlr:
 err_bus:
 	return NULL;
@@ -1469,9 +1469,9 @@ struct vme_resource *vme_lm_request(struct vme_dev *vdev)
 
 err_alloc:
 	/* Unlock image */
-	mutex_lock(&lm->mtx);
-	lm->locked = 0;
-	mutex_unlock(&lm->mtx);
+	mutex_lock(&allocated_lm->mtx);
+	allocated_lm->locked = 0;
+	mutex_unlock(&allocated_lm->mtx);
 err_lm:
 err_bus:
 	return NULL;
-- 
2.43.0

Re: [PATCH] staging: vme_user: avoid iterator variable access outside list loop

[Greg KH]

On Sun, Oct 11, 2026 at 10:40:20PM -0500, Riccardo Oliva wrote:
> In vme_slave_request(), vme_master_request(), vme_dma_request(), and
> vme_lm_request(), the list iterators (slave_image, master_image,
> dma_ctrlr, and lm) are accessed in the err_alloc error paths after
> exiting the list_for_each_entry() loops.
> 
> While the iterator variable retains its pointer value upon hitting a
> break, accessing list iterators outside the loop body violates modern
> kernel coding standards.
> 
> Fix this by referencing the dedicated allocated resource pointers
> (allocated_image, allocated_ctrlr, allocated_lm) in the error cleanup
> blocks instead.
> 
> Signed-off-by: Riccardo Oliva <oliva.scorza@gmail.com>
> ---
> Hi! This is my first patch to the kernel. I am learning the submission 
> workflow. Any feedback is very much appreciated. Thanks!

How was this found and tested?

thanks,

greg k-h

Re: [PATCH] staging: vme_user: avoid iterator variable access outside list loop

[Riccardo Oliva]

> How was this found and tested?
>
> thanks,
>
> greg k-h

This was found using Coccinelle with:
linux/scripts/coccinelle/iterators/use_after_iter.cocci

It was compile-tested on x86_64 using defconfig:
make M=drivers/staging/vme_user

(Note: I do not have access to the physical hardware for testing)

Thanks,
Riccardo Oliva


Il giorno mar 13 ott 2026 alle ore 08:40 Greg KH
<gregkh@linuxfoundation.org> ha scritto:
>
> On Sun, Oct 11, 2026 at 10:40:20PM -0500, Riccardo Oliva wrote:
> > In vme_slave_request(), vme_master_request(), vme_dma_request(), and
> > vme_lm_request(), the list iterators (slave_image, master_image,
> > dma_ctrlr, and lm) are accessed in the err_alloc error paths after
> > exiting the list_for_each_entry() loops.
> >
> > While the iterator variable retains its pointer value upon hitting a
> > break, accessing list iterators outside the loop body violates modern
> > kernel coding standards.
> >
> > Fix this by referencing the dedicated allocated resource pointers
> > (allocated_image, allocated_ctrlr, allocated_lm) in the error cleanup
> > blocks instead.
> >
> > Signed-off-by: Riccardo Oliva <oliva.scorza@gmail.com>
> > ---
> > Hi! This is my first patch to the kernel. I am learning the submission
> > workflow. Any feedback is very much appreciated. Thanks!
>
> How was this found and tested?
>
> thanks,
>
> greg k-h