mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
dcb: use after free in dcb_flushapp()
The original code has a use after free bug because it's not using the _safe() version of the list_for_each_entry() macro. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
70bfa2d2e1
commit
2a8fe00374
|
@ -1643,9 +1643,10 @@ EXPORT_SYMBOL(dcb_setapp);
|
|||
static void dcb_flushapp(void)
|
||||
{
|
||||
struct dcb_app_type *app;
|
||||
struct dcb_app_type *tmp;
|
||||
|
||||
spin_lock(&dcb_lock);
|
||||
list_for_each_entry(app, &dcb_app_list, list) {
|
||||
list_for_each_entry_safe(app, tmp, &dcb_app_list, list) {
|
||||
list_del(&app->list);
|
||||
kfree(app);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue