Staging: unisys: use after free in list_for_each()

PATCH New Dan Carpenter 1 participant 1 message Apr 10, 2014

Subsystems (2)

Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2014-04-10 09:45 UTC #0 lore raw

PATCH 2/2 Staging: unisys: use after free in list_for_each()

These should be using the _safe version of list_for_each() because we free the current element and it leads to a use after free bug.

Signed-off-by Dan Carpenter <[email protected]>

drivers/staging/unisys/visorchipset/visorchipset.h +2 -2

index d4bf203..d95825d 100644
@@ -104,9 +104,9 @@ finddevice(struct list_head *list, U32 busNo, U32 devNo)
 
 static inline void delbusdevices(struct list_head *list, U32 busNo)
 {
-	VISORCHIPSET_DEVICE_INFO *p;
+	VISORCHIPSET_DEVICE_INFO *p, *tmp;
 
-	list_for_each_entry(p, list, entry) {
+	list_for_each_entry_safe(p, tmp, list, entry) {
 		if (p->busNo = busNo) {
 			list_del(&p->entry);
 			kfree(p);

drivers/staging/unisys/visorchipset/visorchipset_main.c +4 -4

index 257c6e5..c475e25 100644
@@ -605,16 +605,16 @@ EXPORT_SYMBOL_GPL(visorchipset_register_busdev_client);
 static void
 cleanup_controlvm_structures(void)
 {
-	VISORCHIPSET_BUS_INFO *bi;
-	VISORCHIPSET_DEVICE_INFO *di;
+	VISORCHIPSET_BUS_INFO *bi, *tmp_bi;
+	VISORCHIPSET_DEVICE_INFO *di, *tmp_di;
 
-	list_for_each_entry(bi, &BusInfoList, entry) {
+	list_for_each_entry_safe(bi, tmp_bi, &BusInfoList, entry) {
 		busInfo_clear(bi);
 		list_del(&bi->entry);
 		kfree(bi);
 	}
 
-	list_for_each_entry(di, &DevInfoList, entry) {
+	list_for_each_entry_safe(di, tmp_di, &DevInfoList, entry) {
 		devInfo_clear(di);
 		list_del(&di->entry);
 		kfree(di);