Skip to contentSkip to conversation

dcb: use after free in dcb_flushapp()

PATCH Applied Dan Carpenter 2 participants 2 messages Jan 5, 2011 – Jan 6, 2011

Subsystems (3)
Networking Network drivers Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 2/2 dcb: use after free in dcb_flushapp()

The original code has a use after free bug because it's not using the _safe() version of the list_for_each_entry() macro.

Signed-off-by Dan Carpenter <[email protected]>
net/dcb/dcbnl.c +2 -1
index 8881cb5..11bf6a2 100644
@@ -1650,9 +1650,10 @@ EXPORT_SYMBOL(dcb_setapp);
 static void dcb_flushapp(void)
 {
 	struct dcb_app_type *app;
+	struct dcb_app_type *tmp;
 
 	spin_lock(&dcb_lock);
-	list_for_each_entry(app, &dcb_app_list, list) {
+	list_for_each_entry_safe(app, tmp, &dcb_app_list, list) {
 		list_del(&app->list);
 		kfree(app);
 	}