[PATCH] RDMA/hns: fix dead empty check on head->root in setup_root_hem()

[PATCH] RDMA/hns: fix dead empty check on head->root in setup_root_hem()

[Maoyi Xie]

setup_root_hem() reads head->root with list_first_entry() and then
tests the returned pointer against NULL. list_first_entry() never
returns NULL. On an empty list it returns container_of(&head->root,
struct hns_roce_hem_item, list), which equals &head->root because
list is the first member. The -ENOMEM early return is dead code.

If head->root is ever empty here, the aliased root_hem points at
&head->root. root_hem->addr and root_hem->dma_addr then read past
the end of struct hns_roce_hem_head into adjacent memory. The
garbage value is handed to the hardware as a DMA base address.

Use list_first_entry_or_null() so the empty case returns NULL and the
-ENOMEM early return runs.

The same shape has been cleaned up elsewhere, for example in
commit fbb8bc408027 ("net: qed: Remove redundant NULL checks after list_first_entry()"),
commit c708d3fad421 ("crypto: atmel - use list_first_entry_or_null to simplify find_dev"),
and commit 10379171f346 ("ksmbd: use list_first_entry_or_null for opinfo_get_list()").
This hns site was missed by those cleanups.

Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
---
 drivers/infiniband/hw/hns/hns_roce_hem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index e7c9e30ad2d8..12ac9ba6b312 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -1267,8 +1267,8 @@ setup_root_hem(struct hns_roce_dev *hr_dev, struct hns_roce_hem_list *hem_list,
 	int i, total;
 	int ret;
 
-	root_hem = list_first_entry(&head->root,
-				    struct hns_roce_hem_item, list);
+	root_hem = list_first_entry_or_null(&head->root,
+					    struct hns_roce_hem_item, list);
 	if (!root_hem)
 		return -ENOMEM;
 
-- 
2.34.1

Re: [PATCH] RDMA/hns: fix dead empty check on head->root in setup_root_hem()

[Jason Gunthorpe]

On Thu, May 21, 2026 at 09:20:45PM +0800, Maoyi Xie wrote:
> --- a/drivers/infiniband/hw/hns/hns_roce_hem.c
> +++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
> @@ -1267,8 +1267,8 @@ setup_root_hem(struct hns_roce_dev *hr_dev, struct hns_roce_hem_list *hem_list,
>  	int i, total;
>  	int ret;
>  
> -	root_hem = list_first_entry(&head->root,
> -				    struct hns_roce_hem_item, list);
> +	root_hem = list_first_entry_or_null(&head->root,
> +					    struct hns_roce_hem_item, list);
>  	if (!root_hem)
>  		return -ENOMEM;

Delete the if, the list can never be empty. The driver immediately
adds an entry after initializing it and never removes entries

Jason

[PATCH v2] RDMA/hns: drop dead empty check in setup_root_hem()

[Maoyi Xie]

setup_root_hem() reads the first entry of head->root and checks
the returned pointer against NULL:

    root_hem = list_first_entry(&head->root,
                                struct hns_roce_hem_item, list);
    if (!root_hem)
        return -ENOMEM;

list_first_entry() never returns NULL. On an empty list it returns
container_of(head, ..., list), a non-NULL garbage pointer that
aliases the head. So the check is dead.

The only caller adds an entry to head.root right before invoking
setup_root_hem():

    list_add(&root_hem->list, &head.root);
    ret = setup_root_hem(..., &head, ...);

So head.root is guaranteed non-empty on entry. Drop the check.

Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
---
v2: drop the check entirely per Jason's review, instead of
    converting to list_first_entry_or_null() as in v1.
v1: https://lore.kernel.org/r/20260521132045.3430906-1-maoyixie.tju@gmail.com

 drivers/infiniband/hw/hns/hns_roce_hem.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index e7c9e30ad2d8..61cd9f96423e 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -1269,8 +1269,6 @@ setup_root_hem(struct hns_roce_dev *hr_dev, struct hns_roce_hem_list *hem_list,
 
 	root_hem = list_first_entry(&head->root,
 				    struct hns_roce_hem_item, list);
-	if (!root_hem)
-		return -ENOMEM;
 
 	total = 0;
 	for (i = 0; i < region_cnt && total <= max_ba_num; i++) {
-- 
2.34.1