Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fb0de5b8 authored by Dan Carpenter's avatar Dan Carpenter Committed by Bjorn Helgaas
Browse files

PCI: endpoint: Use after free in pci_epf_unregister_driver() 



We need to use list_for_each_entry_safe() because the
pci_ep_cfs_remove_epf_group() function frees "group".

Fixes: ef1433f7 ("PCI: endpoint: Create configfs entry for each pci_epf_device_id table entry")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
[lorenzo.pieralisi@arm.com: updated commit log]
Signed-off-by: default avatarLorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
Acked-by: default avatarKishon Vijay Abraham I <kishon@ti.com>
parent 9bc5f083

drivers/pci/endpoint/pci-epf-core.c

+2 −2
Original line number Diff line number Diff line
@@ -145,10 +145,10 @@ EXPORT_SYMBOL_GPL(pci_epf_alloc_space); 
 */

void pci_epf_unregister_driver(struct pci_epf_driver *driver)

{

	struct config_group *group;

	struct config_group *group, *tmp;



	mutex_lock(&pci_epf_mutex);

	list_for_each_entry(group, &driver->epf_group, group_entry)

	list_for_each_entry_safe(group, tmp, &driver->epf_group, group_entry)

		pci_ep_cfs_remove_epf_group(group);

	list_del(&driver->epf_group);

	mutex_unlock(&pci_epf_mutex);