When list_for_each_entry() completes the iteration over the whole list
without breaking the loop, the iterator value will *always* be a bogus
pointer computed based on the head element.

To avoid type confusion use the actual list head directly instead of last
iterator value.

Signed-off-by: Jakob Koschel <jakobkosc...@gmail.com>
---
 drivers/dma/dw-edma/dw-edma-core.c             | 4 ++--
 drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 3 ++-
 drivers/net/wireless/ath/ath6kl/htc_mbox.c     | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/dma/dw-edma/dw-edma-core.c 
b/drivers/dma/dw-edma/dw-edma-core.c
index 468d1097a1ec..7883c4831857 100644
--- a/drivers/dma/dw-edma/dw-edma-core.c
+++ b/drivers/dma/dw-edma/dw-edma-core.c
@@ -136,7 +136,7 @@ static void dw_edma_free_burst(struct dw_edma_chunk *chunk)
        }

        /* Remove the list head */
-       kfree(child);
+       kfree(chunk->burst);
        chunk->burst = NULL;
 }

@@ -156,7 +156,7 @@ static void dw_edma_free_chunk(struct dw_edma_desc *desc)
        }

        /* Remove the list head */
-       kfree(child);
+       kfree(desc->chunk);
        desc->chunk = NULL;
 }

diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c 
b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 091f36adbbe1..c0ea9dbc4ff6 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -3963,7 +3963,8 @@ static void __i40e_reprogram_flex_pit(struct i40e_pf *pf,
         * correctly, the hardware will disable flexible field parsing.
         */
        if (!list_empty(flex_pit_list))
-               last_offset = list_prev_entry(entry, list)->src_offset + 1;
+               last_offset = list_entry(flex_pit_list->prev,
+                                        struct i40e_flex_pit, 
list)->src_offset + 1;

        for (; i < 3; i++, last_offset++) {
                i40e_write_rx_ctl(&pf->hw,
diff --git a/drivers/net/wireless/ath/ath6kl/htc_mbox.c 
b/drivers/net/wireless/ath/ath6kl/htc_mbox.c
index e3874421c4c0..cf5b05860799 100644
--- a/drivers/net/wireless/ath/ath6kl/htc_mbox.c
+++ b/drivers/net/wireless/ath/ath6kl/htc_mbox.c
@@ -104,7 +104,7 @@ static void ath6kl_credit_init(struct 
ath6kl_htc_credit_info *cred_info,
         * it use list_for_each_entry_reverse to walk around the whole ep list.
         * Therefore assign this lowestpri_ep_dist after walk around the ep_list
         */
-       cred_info->lowestpri_ep_dist = cur_ep_dist->list;
+       cred_info->lowestpri_ep_dist = *ep_list;

        WARN_ON(cred_info->cur_free_credits <= 0);

--
2.25.1

Reply via email to