Subject: [merged] rapidio-fix-use-after-free-in-rio_unregister_scan.patch removed from -mm tree To: dan.carpenter@xxxxxxxxxx,alexandre.bounine@xxxxxxx,mporter@xxxxxxxxxxxxxxxxxxx,rmallon@xxxxxxxxx,mm-commits@xxxxxxxxxxxxxxx From: akpm@xxxxxxxxxxxxxxxxxxxx Date: Mon, 05 Aug 2013 12:05:45 -0700 The patch titled Subject: rapidio: fix use after free in rio_unregister_scan() has been removed from the -mm tree. Its filename was rapidio-fix-use-after-free-in-rio_unregister_scan.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Subject: rapidio: fix use after free in rio_unregister_scan() We're freeing the list iterator so we can't move to the next entry. Since there is only one matching mport_id, we can just break after finding it. Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Reviewed-by: Ryan Mallon <rmallon@xxxxxxxxx> Acked-by: Alexandre Bounine <alexandre.bounine@xxxxxxx> Cc: Matt Porter <mporter@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/rapidio/rio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff -puN drivers/rapidio/rio.c~rapidio-fix-use-after-free-in-rio_unregister_scan drivers/rapidio/rio.c --- a/drivers/rapidio/rio.c~rapidio-fix-use-after-free-in-rio_unregister_scan +++ a/drivers/rapidio/rio.c @@ -1715,11 +1715,13 @@ int rio_unregister_scan(int mport_id, st (mport_id == RIO_MPORT_ANY && port->nscan == scan_ops)) port->nscan = NULL; - list_for_each_entry(scan, &rio_scans, node) + list_for_each_entry(scan, &rio_scans, node) { if (scan->mport_id == mport_id) { list_del(&scan->node); kfree(scan); + break; } + } mutex_unlock(&rio_mport_list_lock); _ Patches currently in -mm which might be from dan.carpenter@xxxxxxxxxx are ocfs2-use-list_for_each_entry-instead-of-list_for_each.patch fs-binfmts-better-handling-of-binfmt-loops-fix.patch pktcdvd-convert-printk-to-pr_level.patch linux-next.patch fs-convert-fs-shrinkers-to-new-scan-count-api-fix-fix.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html