projects
/
platform
/
kernel
/
linux-exynos.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
38130c3
)
Bluetooth: 6lowpan: use after free in disconnect_devices()
author
Dan Carpenter
<dan.carpenter@oracle.com>
Wed, 29 Oct 2014 16:10:57 +0000
(19:10 +0300)
committer
Marcel Holtmann
<marcel@holtmann.org>
Thu, 30 Oct 2014 16:23:25 +0000
(17:23 +0100)
This was accidentally changed from list_for_each_entry_safe() to
list_for_each_entry() so now it has a use after free bug. I've changed
it back.
Fixes:
90305829635d
('Bluetooth: 6lowpan: Converting rwlocks to use RCU')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
net/bluetooth/6lowpan.c
patch
|
blob
|
history
diff --git
a/net/bluetooth/6lowpan.c
b/net/bluetooth/6lowpan.c
index
7254bdd
..
eef298d
100644
(file)
--- a/
net/bluetooth/6lowpan.c
+++ b/
net/bluetooth/6lowpan.c
@@
-1383,7
+1383,7
@@
static const struct file_operations lowpan_control_fops = {
static void disconnect_devices(void)
{
- struct lowpan_dev *entry, *new_dev;
+ struct lowpan_dev *entry, *
tmp, *
new_dev;
struct list_head devices;
INIT_LIST_HEAD(&devices);
@@
-1408,7
+1408,7
@@
static void disconnect_devices(void)
rcu_read_unlock();
- list_for_each_entry
(entry
, &devices, list) {
+ list_for_each_entry
_safe(entry, tmp
, &devices, list) {
ifdown(entry->netdev);
BT_DBG("Unregistering netdev %s %p",
entry->netdev->name, entry->netdev);