From aec9db355ce2b930358ade5a71cc00ac258e1b3f Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 30 Aug 2011 03:46:40 +0000 Subject: 6LoWPAN: use the _safe version of list_for_each When we kfree(entry) that causes a use-after-free bug so we have to use list_for_each_entry_safe() safe here. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller --- net/ieee802154/6lowpan.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'net/ieee802154') diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c index 8a9dbaa0434f..5dc04890e0c5 100644 --- a/net/ieee802154/6lowpan.c +++ b/net/ieee802154/6lowpan.c @@ -813,15 +813,17 @@ static void lowpan_dellink(struct net_device *dev, struct list_head *head) struct lowpan_dev_info *lowpan_dev = lowpan_dev_info(dev); struct net_device *real_dev = lowpan_dev->real_dev; struct lowpan_dev_record *entry; + struct lowpan_dev_record *tmp; ASSERT_RTNL(); mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx); - list_for_each_entry(entry, &lowpan_devices, list) + list_for_each_entry_safe(entry, tmp, &lowpan_devices, list) { if (entry->ldev == dev) { list_del(&entry->list); kfree(entry); } + } mutex_unlock(&lowpan_dev_info(dev)->dev_list_mtx); mutex_destroy(&lowpan_dev_info(dev)->dev_list_mtx); -- cgit v1.2.3