Commit-ID: 2d297480037e1d9100ca504737820c1bf65db6c0
Gitweb: http://git.kernel.org/tip/2d297480037e1d9100ca504737820c1bf65db6c0
Author: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
AuthorDate: Wed, 5 Sep 2012 15:30:42 +0300
Committer: Borislav Petkov <borislav.petkov@xxxxxxx>
CommitDate: Wed, 19 Sep 2012 18:06:25 +0200
x86, microcode, AMD: Fix use after free in free_cache()
list_for_each_entry_reverse() dereferences the iterator, but we already
freed it. I don't see a reason that this has to be done in reverse order
so change it to use list_for_each_entry_safe().
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: Borislav Petkov <borislav.petkov@xxxxxxx>
---
arch/x86/kernel/microcode_amd.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index 5511216..7720ff5 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -150,9 +150,9 @@ static void update_cache(struct ucode_patch *new_patch)
static void free_cache(void)
{
- struct ucode_patch *p;
+ struct ucode_patch *p, *tmp;
- list_for_each_entry_reverse(p, &pcache, plist) {
+ list_for_each_entry_safe(p, tmp, &pcache, plist) {
__list_del(p->plist.prev, p->plist.next);
kfree(p->data);
kfree(p);
--
To unsubscribe from this list: send the line "unsubscribe linux-tip-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
|