Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2d297480 authored by Dan Carpenter's avatar Dan Carpenter Committed by Borislav Petkov
Browse files

x86, microcode, AMD: Fix use after free in free_cache() 



list_for_each_entry_reverse() dereferences the iterator, but we already
freed it. I don't see a reason that this has to be done in reverse order
so change it to use list_for_each_entry_safe().

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarBorislav Petkov <borislav.petkov@amd.com>
parent 2efb05e8

arch/x86/kernel/microcode_amd.c

+2 −2
Original line number Diff line number Diff line
@@ -150,9 +150,9 @@ static void update_cache(struct ucode_patch *new_patch) 


static void free_cache(void)

{

	struct ucode_patch *p;

	struct ucode_patch *p, *tmp;



	list_for_each_entry_reverse(p, &pcache, plist) {

	list_for_each_entry_safe(p, tmp, &pcache, plist) {

		__list_del(p->plist.prev, p->plist.next);

		kfree(p->data);

		kfree(p);