diff options
author | Dan Carpenter <error27@gmail.com> | 2011-08-29 23:46:40 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2011-09-15 15:36:32 -0400 |
commit | aec9db355ce2b930358ade5a71cc00ac258e1b3f (patch) | |
tree | b4b444510c1f75b47ed682bd2c24e34ec749da75 /net/ieee802154 | |
parent | 90d0963d17c11188d1d986a235b8aa775c2fb8f2 (diff) |
6LoWPAN: use the _safe version of list_for_each
When we kfree(entry) that causes a use-after-free bug so we have to
use list_for_each_entry_safe() safe here.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ieee802154')
-rw-r--r-- | net/ieee802154/6lowpan.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c index 8a9dbaa0434f..5dc04890e0c5 100644 --- a/net/ieee802154/6lowpan.c +++ b/net/ieee802154/6lowpan.c | |||
@@ -813,15 +813,17 @@ static void lowpan_dellink(struct net_device *dev, struct list_head *head) | |||
813 | struct lowpan_dev_info *lowpan_dev = lowpan_dev_info(dev); | 813 | struct lowpan_dev_info *lowpan_dev = lowpan_dev_info(dev); |
814 | struct net_device *real_dev = lowpan_dev->real_dev; | 814 | struct net_device *real_dev = lowpan_dev->real_dev; |
815 | struct lowpan_dev_record *entry; | 815 | struct lowpan_dev_record *entry; |
816 | struct lowpan_dev_record *tmp; | ||
816 | 817 | ||
817 | ASSERT_RTNL(); | 818 | ASSERT_RTNL(); |
818 | 819 | ||
819 | mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx); | 820 | mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx); |
820 | list_for_each_entry(entry, &lowpan_devices, list) | 821 | list_for_each_entry_safe(entry, tmp, &lowpan_devices, list) { |
821 | if (entry->ldev == dev) { | 822 | if (entry->ldev == dev) { |
822 | list_del(&entry->list); | 823 | list_del(&entry->list); |
823 | kfree(entry); | 824 | kfree(entry); |
824 | } | 825 | } |
826 | } | ||
825 | mutex_unlock(&lowpan_dev_info(dev)->dev_list_mtx); | 827 | mutex_unlock(&lowpan_dev_info(dev)->dev_list_mtx); |
826 | 828 | ||
827 | mutex_destroy(&lowpan_dev_info(dev)->dev_list_mtx); | 829 | mutex_destroy(&lowpan_dev_info(dev)->dev_list_mtx); |