Merge tag 'keystone-driver-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/ssantosh/linux-keystone into next/drivers

Pull "Keystone SOC Navigator driver non critical fixes frm Alex for 3.19" from Santosh Shilimkar:

	- Use list_for_each_entry_safe to prevent use after free
	- Return proper error if devm_kzalloc fails
	- Use list_first_entry_or_null() at appropriate places

* tag 'keystone-driver-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/ssantosh/linux-keystone:
  soc: ti: knav_qmss_queue: Use list_for_each_entry_safe to prevent use after free
  soc: ti: knav_qmss_queue: Return proper error if devm_kzalloc fails
  soc: ti: knav_qmss_queue: Fix unbalanced locking ins knav_pool_create()
  soc: ti: Use list_first_entry_or_null() at appropriate places

Signed-off-by: Arnd Bergmann <arnd@arndb.de>

2 files changed, 11 insertions, 10 deletions

diff --git a/drivers/soc/ti/knav_qmss.h b/drivers/soc/ti/knav_qmss.h
index bc9dcc8cc3ce..51da2341280d 100644
--- a/drivers/soc/ti/knav_qmss.h
+++ b/drivers/soc/ti/knav_qmss.h
@@ -348,15 +348,15 @@ struct knav_range_info {
         list_for_each_entry(region, &kdev->regions, list)
 
 #define first_region(kdev)                                      \
-        list_first_entry(&kdev->regions, \
-                        struct knav_region, list)
+        list_first_entry_or_null(&kdev->regions, \
+                                 struct knav_region, list)
 
 #define for_each_queue_range(kdev, range)                       \
         list_for_each_entry(range, &kdev->queue_ranges, list)
 
 #define first_queue_range(kdev)                                 \
-        list_first_entry(&kdev->queue_ranges, \
-                        struct knav_range_info, list)
+        list_first_entry_or_null(&kdev->queue_ranges, \
+                                 struct knav_range_info, list)
 
 #define for_each_pool(kdev, pool)                               \
         list_for_each_entry(pool, &kdev->pools, list)
diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index 0a2c8634c48b..9b8dd6732681 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -785,7 +785,7 @@ void *knav_pool_create(const char *name,
                 dev_err(kdev->dev, "out of descs in region(%d) for pool(%s)\n",
                         region_id, name);
                 ret = -ENOMEM;
-                goto err;
+                goto err_unlock;
         }
 
         /* Region maintains a sorted (by region offset) list of pools
@@ -815,15 +815,16 @@ void *knav_pool_create(const char *name,
                 dev_err(kdev->dev, "pool(%s) create failed: fragmented desc pool in region(%d)\n",
                         name, region_id);
                 ret = -ENOMEM;
-                goto err;
+                goto err_unlock;
         }
 
         mutex_unlock(&knav_dev_lock);
         kdesc_fill_pool(pool);
         return pool;
 
-err:
+err_unlock:
         mutex_unlock(&knav_dev_lock);
+err:
         kfree(pool->name);
         devm_kfree(kdev->dev, pool);
         return ERR_PTR(ret);
@@ -1305,14 +1306,14 @@ static void knav_free_queue_ranges(struct knav_device *kdev)
 static void knav_queue_free_regions(struct knav_device *kdev)
 {
         struct knav_region *region;
-        struct knav_pool *pool;
+        struct knav_pool *pool, *tmp;
         unsigned size;
 
         for (;;) {
                 region = first_region(kdev);
                 if (!region)
                         break;
-                list_for_each_entry(pool, &region->pools, region_inst)
+                list_for_each_entry_safe(pool, tmp, &region->pools, region_inst)
                         knav_pool_destroy(pool);
 
                 size = region->virt_end - region->virt_start;
@@ -1639,7 +1640,7 @@ static int knav_queue_init_queues(struct knav_device *kdev)
         size = (1 << kdev->inst_shift) * kdev->num_queues_in_use;
         kdev->instances = devm_kzalloc(kdev->dev, size, GFP_KERNEL);
         if (!kdev->instances)
-                return -1;
+                return -ENOMEM;
 
         for_each_queue_range(kdev, range) {
                 if (range->ops && range->ops->init_range)