Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e6b1ea77 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Staging: unisys: use after free in list_for_each() 



These should be using the _safe version of list_for_each() because we
free the current element and it leads to a use after free bug.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d21bb450

drivers/staging/unisys/visorchipset/visorchipset.h

+2 −2
Original line number Diff line number Diff line
@@ -104,9 +104,9 @@ finddevice(struct list_head *list, U32 busNo, U32 devNo) 


static inline void delbusdevices(struct list_head *list, U32 busNo)

{

	VISORCHIPSET_DEVICE_INFO *p;

	VISORCHIPSET_DEVICE_INFO *p, *tmp;



	list_for_each_entry(p, list, entry) {

	list_for_each_entry_safe(p, tmp, list, entry) {

		if (p->busNo == busNo) {

			list_del(&p->entry);

			kfree(p);

drivers/staging/unisys/visorchipset/visorchipset_main.c

+4 −4
Original line number Diff line number Diff line
@@ -605,16 +605,16 @@ EXPORT_SYMBOL_GPL(visorchipset_register_busdev_client); 
static void

cleanup_controlvm_structures(void)

{

	VISORCHIPSET_BUS_INFO *bi;

	VISORCHIPSET_DEVICE_INFO *di;

	VISORCHIPSET_BUS_INFO *bi, *tmp_bi;

	VISORCHIPSET_DEVICE_INFO *di, *tmp_di;



	list_for_each_entry(bi, &BusInfoList, entry) {

	list_for_each_entry_safe(bi, tmp_bi, &BusInfoList, entry) {

		busInfo_clear(bi);

		list_del(&bi->entry);

		kfree(bi);

	}



	list_for_each_entry(di, &DevInfoList, entry) {

	list_for_each_entry_safe(di, tmp_di, &DevInfoList, entry) {

		devInfo_clear(di);

		list_del(&di->entry);

		kfree(di);