Skip to content

Commit

Permalink
V4L/DVB (4994): Vivi: fix use after free in list_for_each()
Browse files Browse the repository at this point in the history
Freeing data including list_head in list_for_each() is not safe.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
  • Loading branch information
Akinobu Mita authored and Mauro Carvalho Chehab committed Dec 27, 2006
1 parent b331daa commit 72f678c
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion drivers/media/video/vivi.c
Original file line number Diff line number Diff line change
Expand Up @@ -1363,7 +1363,9 @@ static void __exit vivi_exit(void)
struct vivi_dev *h;
struct list_head *list;

list_for_each(list,&vivi_devlist) {
while (!list_empty(&vivi_devlist)) {
list = vivi_devlist.next;
list_del(list);
h = list_entry(list, struct vivi_dev, vivi_devlist);
kfree (h);
}
Expand Down

0 comments on commit 72f678c

Please sign in to comment.