Re: [PATCH v2] dmaengine: loongson1-apb-dma: avoid using iterator variable after list_for_each_entry()
From: Frank Li
Date: Tue Sep 15 2026 - 15:24:07 EST
On Fri, Aug 14, 2026 at 03:33:13PM -0400, Frank Li wrote:
> On Wed, Jul 29, 2026 at 02:32:47PM +0000, Mahad Ibrahim wrote:
> > ls1x_dma_tx_status() locates the descriptor actively being processed by
> > walking the LLI list and comparing the hardware reported next descriptor
> > pointer against each element's next-descriptor pointer.
> >
> > A list_for_each_entry macro is used in the comparison phase. Which at
> > the end of the loop leaves the lli pointer at the currently executing LLI.
> > However this also subsequently runs for a non-match lli, in which it
> > points at the head. This causes a type confusion bug which treats the
> > head, which is a ls1x_dma_desc, as a ls1x_dma_lli object. Additionally it
> > goes forwards and prints garbage via the dev_dbg.
> >
> > Fix the type confusion bug by only allowing matched LLI descriptor chains
> > to print the current LLI and residue calculation, as failing to match
> > should be treated as an unexpected condition.
> >
> > Found by the following Coccinelle check:
> >
> > scripts/coccinelle/iterators/use_after_iter.cocci
> >
> > drivers/dma/loongson/loongson1-apb-dma.c:461:6-9: ERROR: invalid
> > reference to the index variable of the iterator on line 450
> >
> > I did not see a bug upstream detailing this error, nor do I have the
> > hardware to confirm this bug or error, all this is from a pure code
> > examination.
> >
> > As I do not possess the hardware, I cannot test the patch. Compile tested
> > only with mips64-linux-gnu-gcc.
>
> Avoid post new patch on old email thread.
>
> Just simple said
>
> Compile test only.
Please updated commit message at v3
Frank