diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2016-11-18 14:34:10 +0300 |
|---|---|---|
| committer | Thierry Reding <treding@nvidia.com> | 2016-11-18 14:32:13 +0100 |
| commit | 68050eb6c611527232fe5574c7306e97e47499ef (patch) | |
| tree | 268a1aa8b6f5250b1c637c3f049ed29baa3e6a0d /drivers/mailbox | |
| parent | 0fe88461a0ec95a71950b4841f139a62ed63dc81 (diff) | |
mailbox: tegra-hsp: Use after free in tegra_hsp_remove_doorbells()
We have to use the _safe version of list_for_each() because we're
freeing the pointer as we go along. (This might not show up testing
depending on what config options you have enabled).
Fixes: 0fe88461a0ec ("mailbox: Add Tegra HSP driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Diffstat (limited to 'drivers/mailbox')
| -rw-r--r-- | drivers/mailbox/tegra-hsp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/mailbox/tegra-hsp.c b/drivers/mailbox/tegra-hsp.c index 3724f2fcd371..0cde356c11ab 100644 --- a/drivers/mailbox/tegra-hsp.c +++ b/drivers/mailbox/tegra-hsp.c @@ -334,12 +334,12 @@ static struct mbox_chan *of_tegra_hsp_xlate(struct mbox_controller *mbox, static void tegra_hsp_remove_doorbells(struct tegra_hsp *hsp) { - struct tegra_hsp_doorbell *db; + struct tegra_hsp_doorbell *db, *tmp; unsigned long flags; spin_lock_irqsave(&hsp->lock, flags); - list_for_each_entry(db, &hsp->doorbells, list) + list_for_each_entry_safe(db, tmp, &hsp->doorbells, list) __tegra_hsp_doorbell_destroy(db); spin_unlock_irqrestore(&hsp->lock, flags); |