aboutsummaryrefslogtreecommitdiff
path: root/net/ieee802154
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2011-08-30 03:46:40 +0000
committerDavid S. Miller <davem@davemloft.net>2011-09-15 15:36:32 -0400
commitaec9db355ce2b930358ade5a71cc00ac258e1b3f (patch)
treeb4b444510c1f75b47ed682bd2c24e34ec749da75 /net/ieee802154
parent90d0963d17c11188d1d986a235b8aa775c2fb8f2 (diff)
downloadlinux-aec9db355ce2b930358ade5a71cc00ac258e1b3f.tar.gz
6LoWPAN: use the _safe version of list_for_each
When we kfree(entry) that causes a use-after-free bug so we have to use list_for_each_entry_safe() safe here. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ieee802154')
-rw-r--r--net/ieee802154/6lowpan.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 8a9dbaa0434..5dc04890e0c 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -813,15 +813,17 @@ static void lowpan_dellink(struct net_device *dev, struct list_head *head)
struct lowpan_dev_info *lowpan_dev = lowpan_dev_info(dev);
struct net_device *real_dev = lowpan_dev->real_dev;
struct lowpan_dev_record *entry;
+ struct lowpan_dev_record *tmp;
ASSERT_RTNL();
mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx);
- list_for_each_entry(entry, &lowpan_devices, list)
+ list_for_each_entry_safe(entry, tmp, &lowpan_devices, list) {
if (entry->ldev == dev) {
list_del(&entry->list);
kfree(entry);
}
+ }
mutex_unlock(&lowpan_dev_info(dev)->dev_list_mtx);
mutex_destroy(&lowpan_dev_info(dev)->dev_list_mtx);