Commit f93f3c4e authored by Dan Carpenter's avatar Dan Carpenter Committed by Linus Torvalds

rapidio: fix use after free in rio_unregister_scan()

We're freeing the list iterator so we can't move to the next entry.
Since there is only one matching mport_id, we can just break after
finding it.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarRyan Mallon <rmallon@gmail.com>
Acked-by: default avatarAlexandre Bounine <alexandre.bounine@idt.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 4e505294
...@@ -1715,10 +1715,12 @@ int rio_unregister_scan(int mport_id, struct rio_scan *scan_ops) ...@@ -1715,10 +1715,12 @@ int rio_unregister_scan(int mport_id, struct rio_scan *scan_ops)
(mport_id == RIO_MPORT_ANY && port->nscan == scan_ops)) (mport_id == RIO_MPORT_ANY && port->nscan == scan_ops))
port->nscan = NULL; port->nscan = NULL;
list_for_each_entry(scan, &rio_scans, node) list_for_each_entry(scan, &rio_scans, node) {
if (scan->mport_id == mport_id) { if (scan->mport_id == mport_id) {
list_del(&scan->node); list_del(&scan->node);
kfree(scan); kfree(scan);
break;
}
} }
mutex_unlock(&rio_mport_list_lock); mutex_unlock(&rio_mport_list_lock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment