From patchwork Sat Nov 1 05:33:13 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Axel Lin X-Patchwork-Id: 5208471 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 05359C11AC for ; Sat, 1 Nov 2014 05:37:21 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 48F5B20220 for ; Sat, 1 Nov 2014 05:37:20 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 2C1DE20212 for ; Sat, 1 Nov 2014 05:37:19 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1XkRJk-0001Hx-Na; Sat, 01 Nov 2014 05:33:40 +0000 Received: from mail-pa0-f46.google.com ([209.85.220.46]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1XkRJj-0001GW-0f for linux-arm-kernel@lists.infradead.org; Sat, 01 Nov 2014 05:33:39 +0000 Received: by mail-pa0-f46.google.com with SMTP id lf10so8997944pab.33 for ; Fri, 31 Oct 2014 22:33:17 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:subject:from:to:cc:date:content-type :mime-version:content-transfer-encoding; bh=2UHRZtPlM+i0MZhzMj82FdRTSqjE7VYYQd6Ut+coXXk=; b=ZgvGzMC/Np8J+AfdEDHclW7U9Cw4f2uuDoCGbwvstXCsF+/5qDknvV3/W00g+y1NV4 fHOE7Ar9dNTGR35k18lLjwgeUDUbe8C3B9ZQ6NbsMN1XPx6IiUDpPvN9UQoJOog0h0Ol 5s5UCdy6VarL2kDmhpZkI+n9Ma7hgGB6a7Zq5rpyBOrFIw3OnHpTNf/yvMIvfJKPMC02 21sh4lkCVugwwA2YHMJaobuteeyqPglfRdyQqzjM0c6RxAcLbv7GvDMn6pj2D4RYe0+l CqM/dU5AE4YaJC58jWzAkbfqPwZeReKeU6HMwZFfS8r+kM6QWrLOjaFu6+OQyKFaneO3 CYFw== X-Gm-Message-State: ALoCoQmxzaGHz0bvrCCPDoJSjuH+EkaCGtaWLZwT1MIqfKppKuT7QpP1C+BHzeAazm4yYE7nMOEE X-Received: by 10.70.21.168 with SMTP id w8mr18374282pde.95.1414819997089; Fri, 31 Oct 2014 22:33:17 -0700 (PDT) Received: from [192.168.0.105] (218-164-102-130.dynamic.hinet.net. [218.164.102.130]) by mx.google.com with ESMTPSA id tv4sm11471553pab.28.2014.10.31.22.33.15 for (version=SSLv3 cipher=RC4-SHA bits=128/128); Fri, 31 Oct 2014 22:33:16 -0700 (PDT) Message-ID: <1414819993.23500.1.camel@phoenix> Subject: [PATCH] soc: ti: knav_qmss_queue: Use list_for_each_entry_safe to prevent use after free From: Axel Lin To: Santosh Shilimkar Date: Sat, 01 Nov 2014 13:33:13 +0800 X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20141031_223339_075413_DC277CCF X-CRM114-Status: GOOD ( 10.04 ) X-Spam-Score: -0.7 (/) Cc: Sandeep Nair , linux-arm-kernel , linux-kernel@vger.kernel.org X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Spam-Status: No, score=-2.5 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_NONE, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP list_for_each_entry_safe() is necessary if list objects are deleted from the list while traversing it. Signed-off-by: Axel Lin --- drivers/soc/ti/knav_qmss_queue.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c index 6f22d56..9b8dd67 100644 --- a/drivers/soc/ti/knav_qmss_queue.c +++ b/drivers/soc/ti/knav_qmss_queue.c @@ -1306,14 +1306,14 @@ static void knav_free_queue_ranges(struct knav_device *kdev) static void knav_queue_free_regions(struct knav_device *kdev) { struct knav_region *region; - struct knav_pool *pool; + struct knav_pool *pool, *tmp; unsigned size; for (;;) { region = first_region(kdev); if (!region) break; - list_for_each_entry(pool, ®ion->pools, region_inst) + list_for_each_entry_safe(pool, tmp, ®ion->pools, region_inst) knav_pool_destroy(pool); size = region->virt_end - region->virt_start;