If the cell list is not empty and nvmem_find_cell_by_node/name() is
called for a cell that is not present in the list they will return an
invalid pointer instead of NULL. This happen because
list_for_each_entry() stop once it reach the list head again, but as
the list head is not contained in a struct nvmem_cell the iteration
variable then contains an invalid value.

This is easily solved by using a variable to iterate over the list and
one to return the cell found.

Signed-off-by: Alban Bedel <al...@free.fr>
---
 drivers/nvmem/core.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 8e1b52559467..a7556b20cff4 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -525,12 +525,14 @@ static int nvmem_add_cells_from_table(struct nvmem_device 
*nvmem)
 static struct nvmem_cell *
 nvmem_find_cell_by_name(struct nvmem_device *nvmem, const char *cell_id)
 {
-       struct nvmem_cell *cell = NULL;
+       struct nvmem_cell *iter, *cell = NULL;
 
        mutex_lock(&nvmem_mutex);
-       list_for_each_entry(cell, &nvmem->cells, node) {
-               if (strcmp(cell_id, cell->name) == 0)
+       list_for_each_entry(iter, &nvmem->cells, node) {
+               if (strcmp(cell_id, iter->name) == 0) {
+                       cell = iter;
                        break;
+               }
        }
        mutex_unlock(&nvmem_mutex);
 
@@ -994,12 +996,14 @@ nvmem_cell_get_from_lookup(struct device *dev, const char 
*con_id)
 static struct nvmem_cell *
 nvmem_find_cell_by_node(struct nvmem_device *nvmem, struct device_node *np)
 {
-       struct nvmem_cell *cell = NULL;
+       struct nvmem_cell *iter, *cell = NULL;
 
        mutex_lock(&nvmem_mutex);
-       list_for_each_entry(cell, &nvmem->cells, node) {
-               if (np == cell->np)
+       list_for_each_entry(iter, &nvmem->cells, node) {
+               if (np == iter->np) {
+                       cell = iter;
                        break;
+               }
        }
        mutex_unlock(&nvmem_mutex);
 
-- 
2.19.1

Reply via email to