diff options
| author | Dan Carpenter <[email protected]> | 2018-06-29 13:49:24 -0500 |
|---|---|---|
| committer | Bjorn Helgaas <[email protected]> | 2018-06-29 13:49:24 -0500 |
| commit | fb0de5b8dcc68da4a0d39b0f5fcd5368085ad7c1 (patch) | |
| tree | 5612b376ed6aaa45ea6b924b61d11a35ecad3f01 | |
| parent | 9bc5f0833a55c7bf768d517b5fdcf89ead43b794 (diff) | |
PCI: endpoint: Use after free in pci_epf_unregister_driver()
We need to use list_for_each_entry_safe() because the
pci_ep_cfs_remove_epf_group() function frees "group".
Fixes: ef1433f717a2 ("PCI: endpoint: Create configfs entry for each pci_epf_device_id table entry")
Signed-off-by: Dan Carpenter <[email protected]>
[[email protected]: updated commit log]
Signed-off-by: Lorenzo Pieralisi <[email protected]>
Signed-off-by: Bjorn Helgaas <[email protected]>
Acked-by: Kishon Vijay Abraham I <[email protected]>
| -rw-r--r-- | drivers/pci/endpoint/pci-epf-core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/pci/endpoint/pci-epf-core.c b/drivers/pci/endpoint/pci-epf-core.c index 523a8cab3bfb..bf53fad636a5 100644 --- a/drivers/pci/endpoint/pci-epf-core.c +++ b/drivers/pci/endpoint/pci-epf-core.c @@ -145,10 +145,10 @@ EXPORT_SYMBOL_GPL(pci_epf_alloc_space); */ void pci_epf_unregister_driver(struct pci_epf_driver *driver) { - struct config_group *group; + struct config_group *group, *tmp; mutex_lock(&pci_epf_mutex); - list_for_each_entry(group, &driver->epf_group, group_entry) + list_for_each_entry_safe(group, tmp, &driver->epf_group, group_entry) pci_ep_cfs_remove_epf_group(group); list_del(&driver->epf_group); mutex_unlock(&pci_epf_mutex); |