driver core: check start node in klist_iter_init_node

klist_iter_init_node() takes a node as a start argument.
However, this node might not be valid anymore.
This patch updates the klist_iter_init_node() and
dependent functions to return an error if so.
All calling functions have been audited to check
for a return code here.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Cc: Greg Kroah-Hartmann <gregkh@linuxfoundation.org>
Cc: Kay Sievers <kay@vrfy.org>
Cc: Stable Kernel <stable@kernel.org>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 11 insertions, 7 deletions

diff --git a/drivers/base/driver.c b/drivers/base/driver.c
index 3ec3896c83a6..16f6dd2c4403 100644
--- a/drivers/base/driver.c
+++ b/drivers/base/driver.c
@@ -49,11 +49,13 @@ int driver_for_each_device(struct device_driver *drv, struct device *start,
         if (!drv)
                 return -EINVAL;
 
-        klist_iter_init_node(&drv->p->klist_devices, &i,
-                             start ? &start->p->knode_driver : NULL);
-        while ((dev = next_device(&i)) && !error)
-                error = fn(dev, data);
-        klist_iter_exit(&i);
+        error = klist_iter_init_node(&drv->p->klist_devices, &i,
+                                     start ? &start->p->knode_driver : NULL);
+        if (!error) {
+                while ((dev = next_device(&i)) && !error)
+                        error = fn(dev, data);
+                klist_iter_exit(&i);
+        }
         return error;
 }
 EXPORT_SYMBOL_GPL(driver_for_each_device);
@@ -83,8 +85,10 @@ struct device *driver_find_device(struct device_driver *drv,
         if (!drv)
                 return NULL;
 
-        klist_iter_init_node(&drv->p->klist_devices, &i,
-                             (start ? &start->p->knode_driver : NULL));
+        if (klist_iter_init_node(&drv->p->klist_devices, &i,
+                                 (start ? &start->p->knode_driver : NULL)) < 0)
+                return NULL;
+
         while ((dev = next_device(&i)))
                 if (match(dev, data) && get_device(dev))
                         break;