lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 05 Jul 2013 17:06:14 +1000 From: Ryan Mallon <rmallon@...il.com> To: Dan Carpenter <dan.carpenter@...cle.com> CC: Matt Porter <mporter@...nel.crashing.org>, Alexandre Bounine <alexandre.bounine@....com>, linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org Subject: Re: [patch] rapidio: use after free in unregister function On 05/07/13 16:02, Dan Carpenter wrote: > We need to use the _safe version of list_for_each_entry() because we > are freeing the iterator. > > Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com> > > diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c > index f4f30af..84ac64a 100644 > --- a/drivers/rapidio/rio.c > +++ b/drivers/rapidio/rio.c > @@ -1701,7 +1701,7 @@ EXPORT_SYMBOL_GPL(rio_register_scan); > int rio_unregister_scan(int mport_id, struct rio_scan *scan_ops) > { > struct rio_mport *port; > - struct rio_scan_node *scan; > + struct rio_scan_node *scan, *tmp; > > pr_debug("RIO: %s for mport_id=%d\n", __func__, mport_id); > > @@ -1715,7 +1715,7 @@ int rio_unregister_scan(int mport_id, struct rio_scan *scan_ops) > (mport_id == RIO_MPORT_ANY && port->nscan == scan_ops)) > port->nscan = NULL; > > - list_for_each_entry(scan, &rio_scans, node) > + list_for_each_entry_safe(scan, tmp, &rio_scans, node) > if (scan->mport_id == mport_id) { > list_del(&scan->node); > kfree(scan); It looks like an mport_id can only be assigned to one scan entry (see rio_register_scan), so you can use list_for_each_entry and break; after the kfree(scan); instead. ~Ryan -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists