Commit 2a8fe003 authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

dcb: use after free in dcb_flushapp() 



The original code has a use after free bug because it's not using the
_safe() version of the list_for_each_entry() macro.

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 70bfa2d2

net/dcb/dcbnl.c

+2 −1
Original line number Diff line number Diff line
@@ -1643,9 +1643,10 @@ EXPORT_SYMBOL(dcb_setapp); 
static void dcb_flushapp(void)

{

	struct dcb_app_type *app;

	struct dcb_app_type *tmp;



	spin_lock(&dcb_lock);

	list_for_each_entry(app, &dcb_app_list, list) {

	list_for_each_entry_safe(app, tmp, &dcb_app_list, list) {

		list_del(&app->list);

		kfree(app);

	}