Skip to content

Commit

Permalink
x86, microcode, AMD: Fix use after free in free_cache()
Browse files Browse the repository at this point in the history
list_for_each_entry_reverse() dereferences the iterator, but we already
freed it. I don't see a reason that this has to be done in reverse order
so change it to use list_for_each_entry_safe().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
  • Loading branch information
Dan Carpenter authored and Borislav Petkov committed Sep 19, 2012
1 parent 2efb05e commit 2d29748
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions arch/x86/kernel/microcode_amd.c
Original file line number Diff line number Diff line change
Expand Up @@ -150,9 +150,9 @@ static void update_cache(struct ucode_patch *new_patch)

static void free_cache(void)
{
struct ucode_patch *p;
struct ucode_patch *p, *tmp;

list_for_each_entry_reverse(p, &pcache, plist) {
list_for_each_entry_safe(p, tmp, &pcache, plist) {
__list_del(p->plist.prev, p->plist.next);
kfree(p->data);
kfree(p);
Expand Down

0 comments on commit 2d29748

Please sign in to comment.