Skip to content

Commit

Permalink
Staging: unisys: use after free in list_for_each()
Browse files Browse the repository at this point in the history
These should be using the _safe version of list_for_each() because we
free the current element and it leads to a use after free bug.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Dan Carpenter authored and Greg Kroah-Hartman committed Apr 16, 2014
1 parent d21bb45 commit e6b1ea7
Showing 2 changed files with 6 additions and 6 deletions.
4 changes: 2 additions & 2 deletions drivers/staging/unisys/visorchipset/visorchipset.h
Original file line number Diff line number Diff line change
@@ -104,9 +104,9 @@ finddevice(struct list_head *list, U32 busNo, U32 devNo)

static inline void delbusdevices(struct list_head *list, U32 busNo)
{
VISORCHIPSET_DEVICE_INFO *p;
VISORCHIPSET_DEVICE_INFO *p, *tmp;

list_for_each_entry(p, list, entry) {
list_for_each_entry_safe(p, tmp, list, entry) {
if (p->busNo == busNo) {
list_del(&p->entry);
kfree(p);
8 changes: 4 additions & 4 deletions drivers/staging/unisys/visorchipset/visorchipset_main.c
Original file line number Diff line number Diff line change
@@ -605,16 +605,16 @@ EXPORT_SYMBOL_GPL(visorchipset_register_busdev_client);
static void
cleanup_controlvm_structures(void)
{
VISORCHIPSET_BUS_INFO *bi;
VISORCHIPSET_DEVICE_INFO *di;
VISORCHIPSET_BUS_INFO *bi, *tmp_bi;
VISORCHIPSET_DEVICE_INFO *di, *tmp_di;

list_for_each_entry(bi, &BusInfoList, entry) {
list_for_each_entry_safe(bi, tmp_bi, &BusInfoList, entry) {
busInfo_clear(bi);
list_del(&bi->entry);
kfree(bi);
}

list_for_each_entry(di, &DevInfoList, entry) {
list_for_each_entry_safe(di, tmp_di, &DevInfoList, entry) {
devInfo_clear(di);
list_del(&di->entry);
kfree(di);

0 comments on commit e6b1ea7

Please sign in to comment.