luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

dcb: use after free in dcb_flushapp()

Browse Source 
The original code has a use after free bug because it's not using the
_safe() version of the list_for_each_entry() macro.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Dan Carpenter 2011-01-04 21:03:44 +00:00 committed by David S. Miller
parent 70bfa2d2e1
commit 2a8fe00374
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/dcb/dcbnl.c
View File

@ -1643,9 +1643,10 @@ EXPORT_SYMBOL(dcb_setapp);
static void dcb_flushapp(void)
{
struct dcb_app_type *app;
struct dcb_app_type *tmp;
spin_lock(&dcb_lock);
list_for_each_entry(app, &dcb_app_list, list) {
list_for_each_entry_safe(app, tmp, &dcb_app_list, list) {
list_del(&app->list);
kfree(app);
}