[PATCH 02/20] ptrlist: Guard against null list in ptrlist operations

[Bart Van Assche <bvanassche@acm.org>]

Guard against null list pointers before accessing list->rm in ptrlist.h
and ptrlist.c to eliminate undefined behavior and UBSan null member
access traps.

Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 ptrlist.c | 47 +++++++++++++++++++++++++++++++++--------------
 ptrlist.h | 14 ++++++++++----
 2 files changed, 43 insertions(+), 18 deletions(-)

diff --git a/ptrlist.c b/ptrlist.c
index c5766002e7ef..29fea6a35c70 100644
--- a/ptrlist.c
+++ b/ptrlist.c
@@ -165,19 +165,21 @@ void *ptr_list_nth_entry(struct ptr_list *list, unsigned int idx)
 int linearize_ptr_list(struct ptr_list *head, void **arr, int max)
 {
 	int nr = 0;
-	if (head && max > 0) {
+	if (head && max >= 0) {
 		struct ptr_list *list = head;
 
 		do {
-			int i = list->nr;
-			nr += i;
-			if (max == 0)
-				continue;
-			if (i > max) 
-				i = max;
-			memcpy(arr, list->list, i*sizeof(void *));
-			arr += i;
-			max -= i;
+			int i;
+			for (i = 0; i < list->nr; i++) {
+				void *ptr = list->list[i];
+				if (list->rm && !ptr)
+					continue;
+				nr++;
+				if (max > 0) {
+					*arr++ = ptr;
+					max--;
+				}
+			}
 		} while ((list = list->next) != head);
 	}
 	return nr;
@@ -247,6 +249,15 @@ void split_ptr_list_head(struct ptr_list *head)
 	newlist->nr = nr;
 	memcpy(newlist->list, head->list + old, nr * sizeof(void *));
 	memset(head->list + old, 0xf0, nr * sizeof(void *));
+	if (head->rm) {
+		int i, rm = 0;
+		for (i = 0; i < nr; i++) {
+			if (!newlist->list[i])
+				rm++;
+		}
+		newlist->rm = rm;
+		head->rm -= rm;
+	}
 }
 
 ///
@@ -409,10 +420,18 @@ void * delete_ptr_list_last(struct ptr_list **head)
 
 	if (!first)
 		return NULL;
-	last = first->prev;
-	if (last->nr)
-		ptr = last->list[--last->nr];
-	if (last->nr <=0) {
+	while ((last = first->prev)->nr == 0) {
+		if (last == first) {
+			*head = NULL;
+			__free_ptrlist(last);
+			return NULL;
+		}
+		first->prev = last->prev;
+		last->prev->next = first;
+		__free_ptrlist(last);
+	}
+	ptr = last->list[--last->nr];
+	if (last->nr <= 0) {
 		first->prev = last->prev;
 		last->prev->next = first;
 		if (last == first)
diff --git a/ptrlist.h b/ptrlist.h
index 5a3dcbeb97ae..89f15d53fa13 100644
--- a/ptrlist.h
+++ b/ptrlist.h
@@ -11,7 +11,7 @@
  */
 
 /* Silly type-safety check ;) */
-#define CHECK_TYPE(head,ptr)		(void)(&(ptr) == &(head)->list[0])
+#define CHECK_TYPE(head,ptr)		(void)sizeof(&(ptr) == &(head)->list[0])
 #define PTRLIST_TYPE(head)		__typeof__((head)->list[0])
 #define VRFY_PTR_LIST(head)		(void)(sizeof((head)->list[0]))
 
@@ -163,15 +163,19 @@ extern void __free_ptr_list(struct ptr_list **);
 
 
 #define PTR_NEXT(ptr, __head, __list, __nr, PTR_ENTRY)			\
-	do {								\
+	for (;;) {							\
 		if (__nr < __list->nr) {				\
 			ptr = PTR_ENTRY(__list,__nr);			\
 			__nr++;						\
+			if (__list->rm && !ptr)				\
+				continue;				\
 			break;						\
 		}							\
 		ptr = NULL;						\
 		__nr = 0;						\
-	} while ((__list = __list->next) != __head)			\
+		if ((__list = __list->next) == __head)			\
+			break;						\
+	}			\
 
 #define DO_PREPARE(head, ptr, __head, __list, __nr, PTR_ENTRY)		\
 	do {								\
@@ -224,7 +228,7 @@ extern void __free_ptr_list(struct ptr_list **);
 	__typeof__(head) __list = __head;				\
 	__typeof__(head) __name = __head;				\
 	int __nr;							\
-	if (!head)							\
+	if (!__head)							\
 		break;							\
 	do {								\
 		__list = __list->prev;					\
@@ -255,6 +259,8 @@ extern void __free_ptr_list(struct ptr_list **);
 	__inside##new:							\
 		while (--__newnr >= 0) {				\
 			new = PTR_ENTRY(__newlist,__newnr);		\
+			if (__newlist->rm && !new)			\
+				continue;		\
 
 #define DO_THIS_ADDRESS(ptr, __head, __list, __nr)			\
 	(&__list->list[__nr])