From 2a8fe003741aa90b6b9453e90af4bbb7bc42918c Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 4 Jan 2011 21:03:44 +0000 Subject: dcb: use after free in dcb_flushapp() The original code has a use after free bug because it's not using the _safe() version of the list_for_each_entry() macro. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller --- net/dcb/dcbnl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c index 4323bd441f0..d900ab99814 100644 --- a/net/dcb/dcbnl.c +++ b/net/dcb/dcbnl.c @@ -1643,9 +1643,10 @@ EXPORT_SYMBOL(dcb_setapp); static void dcb_flushapp(void) { struct dcb_app_type *app; + struct dcb_app_type *tmp; spin_lock(&dcb_lock); - list_for_each_entry(app, &dcb_app_list, list) { + list_for_each_entry_safe(app, tmp, &dcb_app_list, list) { list_del(&app->list); kfree(app); } -- cgit v1.2.3-70-g09d2