Skip to contentSkip to conversation

Use after free in mtd/phram.c: unregister_devices()

PATCH In review Alexander Nyberg 2 participants 2 messages Feb 23, 2005

Subsystems (2)
Memory technology devices (MTD) Phram MTD driver
lore
Share & tools
lore

Alexander Nyberg

author
#0 lore raw

PATCH 1/1 Use after free in mtd/phram.c: unregister_devices()

Use after free, found by the Coverity tool

Signed-off-by Alexander Nyberg <[email protected]>

===== drivers/mtd/devices/phram.c 1.6 vs edited =====

drivers/mtd/devices/phram.c +2 -2
@@ -107,9 +107,9 @@ static int phram_write(struct mtd_info *
 
 static void unregister_devices(void)
 {
-	struct phram_mtd_list *this;
+	struct phram_mtd_list *this, *safe;
 
-	list_for_each_entry(this, &phram_list, list) {
+	list_for_each_entry_safe(this, safe, &phram_list, list) {
 		del_mtd_device(&this->mtd);
 		iounmap(this->mtd.priv);
 		kfree(this);
#1 lore raw
Quoted 2 lines · Alexander Nyberg

Use after free, found by the Coverity tool

Thanks!

Quoted 8 lines
Signed-off-by Alexander Nyberg <[email protected]>

===== drivers/mtd/devices/phram.c 1.6 vs edited =====

drivers/mtd/devices/phram.c +0 -0
@@ -107,9 +107,9 @@ static int phram_write(struct mtd_info *

drivers/mtd/devices/phram.c static int phram_write(struct mtd_info * · line 115

Quoted 10 lines
drivers/mtd/devices/phram.c +2 -2
 static void unregister_devices(void)
 {
-	struct phram_mtd_list *this;
+	struct phram_mtd_list *this, *safe;
 
-	list_for_each_entry(this, &phram_list, list) {
+	list_for_each_entry_safe(this, safe, &phram_list, list) {
 		del_mtd_device(&this->mtd);
 		iounmap(this->mtd.priv);
 		kfree(this);

Jörn

Signature · 3 lines
But this is not to say that the main benefit of Linux and other GPL
software is lower-cost. Control is the main benefit--cost is secondary.
-- Bruce Perens