6LoWPAN: use the _safe version of list_for_each
When we kfree(entry) that causes a use-after-free bug so we have to use list_for_each_entry_safe() safe here. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
90d0963d17
commit
aec9db355c
1 changed files with 3 additions and 1 deletions
|
@ -813,15 +813,17 @@ static void lowpan_dellink(struct net_device *dev, struct list_head *head)
|
||||||
struct lowpan_dev_info *lowpan_dev = lowpan_dev_info(dev);
|
struct lowpan_dev_info *lowpan_dev = lowpan_dev_info(dev);
|
||||||
struct net_device *real_dev = lowpan_dev->real_dev;
|
struct net_device *real_dev = lowpan_dev->real_dev;
|
||||||
struct lowpan_dev_record *entry;
|
struct lowpan_dev_record *entry;
|
||||||
|
struct lowpan_dev_record *tmp;
|
||||||
|
|
||||||
ASSERT_RTNL();
|
ASSERT_RTNL();
|
||||||
|
|
||||||
mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx);
|
mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx);
|
||||||
list_for_each_entry(entry, &lowpan_devices, list)
|
list_for_each_entry_safe(entry, tmp, &lowpan_devices, list) {
|
||||||
if (entry->ldev == dev) {
|
if (entry->ldev == dev) {
|
||||||
list_del(&entry->list);
|
list_del(&entry->list);
|
||||||
kfree(entry);
|
kfree(entry);
|
||||||
}
|
}
|
||||||
|
}
|
||||||
mutex_unlock(&lowpan_dev_info(dev)->dev_list_mtx);
|
mutex_unlock(&lowpan_dev_info(dev)->dev_list_mtx);
|
||||||
|
|
||||||
mutex_destroy(&lowpan_dev_info(dev)->dev_list_mtx);
|
mutex_destroy(&lowpan_dev_info(dev)->dev_list_mtx);
|
||||||
|
|
Loading…
Reference in a new issue