Subject: + rapidio-fix-use-after-free-in-rio_unregister_scan.patch added to -mm tree
To: dan.carpenter@xxxxxxxxxx,alexandre.bounine@xxxxxxx,mporter@xxxxxxxxxxxxxxxxxxx,rmallon@xxxxxxxxx
From: akpm@xxxxxxxxxxxxxxxxxxxx
Date: Thu, 11 Jul 2013 15:04:32 -0700
The patch titled
Subject: rapidio: fix use after free in rio_unregister_scan()
has been added to the -mm tree. Its filename is
rapidio-fix-use-after-free-in-rio_unregister_scan.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/rapidio-fix-use-after-free-in-rio_unregister_scan.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/rapidio-fix-use-after-free-in-rio_unregister_scan.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Subject: rapidio: fix use after free in rio_unregister_scan()
We're freeing the list iterator so we can't move to the next entry. Since
there is only one matching mport_id, we can just break after finding it.
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Reviewed-by: Ryan Mallon <rmallon@xxxxxxxxx>
Acked-by: Alexandre Bounine <alexandre.bounine@xxxxxxx>
Cc: Matt Porter <mporter@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
drivers/rapidio/rio.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff -puN drivers/rapidio/rio.c~rapidio-fix-use-after-free-in-rio_unregister_scan drivers/rapidio/rio.c
--- a/drivers/rapidio/rio.c~rapidio-fix-use-after-free-in-rio_unregister_scan
+++ a/drivers/rapidio/rio.c
@@ -1715,11 +1715,13 @@ int rio_unregister_scan(int mport_id, st
(mport_id == RIO_MPORT_ANY && port->nscan == scan_ops))
port->nscan = NULL;
- list_for_each_entry(scan, &rio_scans, node)
+ list_for_each_entry(scan, &rio_scans, node) {
if (scan->mport_id == mport_id) {
list_del(&scan->node);
kfree(scan);
+ break;
}
+ }
mutex_unlock(&rio_mport_list_lock);
_
Patches currently in -mm which might be from dan.carpenter@xxxxxxxxxx are
origin.patch
linux-next.patch
rapidio-fix-use-after-free-in-rio_unregister_scan.patch
fs-convert-fs-shrinkers-to-new-scan-count-api-fix-fix.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
