diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-04-10 12:45:45 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-04-16 11:41:45 -0700 |
| commit | e6b1ea773e0a6dd611278d0d6f81ea6ff9d6938b (patch) | |
| tree | a8db6f2bccbb5de07024d11eb83ffcb8c0c48be4 /drivers/staging/unisys/visorchipset/visorchipset.h | |
| parent | d21bb45081484b95fb0c80f1afa492a7275689c2 (diff) | |
Staging: unisys: use after free in list_for_each()
These should be using the _safe version of list_for_each() because we
free the current element and it leads to a use after free bug.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/unisys/visorchipset/visorchipset.h')
| -rw-r--r-- | drivers/staging/unisys/visorchipset/visorchipset.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/staging/unisys/visorchipset/visorchipset.h b/drivers/staging/unisys/visorchipset/visorchipset.h index d4bf203cdfdf..d95825dc5414 100644 --- a/drivers/staging/unisys/visorchipset/visorchipset.h +++ b/drivers/staging/unisys/visorchipset/visorchipset.h @@ -104,9 +104,9 @@ finddevice(struct list_head *list, U32 busNo, U32 devNo) static inline void delbusdevices(struct list_head *list, U32 busNo) { - VISORCHIPSET_DEVICE_INFO *p; + VISORCHIPSET_DEVICE_INFO *p, *tmp; - list_for_each_entry(p, list, entry) { + list_for_each_entry_safe(p, tmp, list, entry) { if (p->busNo == busNo) { list_del(&p->entry); kfree(p); |