Messages in this thread | | | From | "Bounine, Alexandre" <> | Subject | RE: [patch v2] rapidio: use after free in unregister function | Date | Mon, 8 Jul 2013 11:55:56 +0000 |
| |
On Friday, July 05, 2013 4:39 PM, Dan Carpenter wrote:
> We're freeing the list iterator so we can't move to the next entry. > Since there is only one matching mport_id, we can just break after > finding it. > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > v2: cleaner fix than v1 > > diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c > index f4f30af..2e8a20c 100644 > --- a/drivers/rapidio/rio.c > +++ b/drivers/rapidio/rio.c > @@ -1715,11 +1715,13 @@ int rio_unregister_scan(int mport_id, struct > rio_scan *scan_ops) > (mport_id == RIO_MPORT_ANY && port->nscan == scan_ops)) > port->nscan = NULL; > > - list_for_each_entry(scan, &rio_scans, node) > + list_for_each_entry(scan, &rio_scans, node) { > if (scan->mport_id == mport_id) { > list_del(&scan->node); > kfree(scan); > + break; > } > + } > > mutex_unlock(&rio_mport_list_lock); >
Acked-by: Alexandre Bounine <alexandre.bounine@idt.com>
| |