summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNicholas Krause <xerofoify@gmail.com>2015-01-31 08:17:54 +0300
committerCorey Minyard <cminyard@mvista.com>2015-02-20 05:58:40 +0300
commitbdf2829cb673afc3aeb4f04531546c7605e8d94e (patch)
tree4ab83da8ee48cda6bf48916cdc4e448d2f718dc1
parent191cc41405188780e5f8f3c90d84a1e747d962e9 (diff)
downloadlinux-bdf2829cb673afc3aeb4f04531546c7605e8d94e.tar.xz
ipmi: Free ipmi_recv_msg messages from the linked list on close
This adds a loop through the elements in the linked list, recv_msgs using list_for_entry_safe in order to free messages in this list. In addition we are using the safe version of this marco in order to prevent use after bugs related to deleting the element we are on currently by holding a pointer to the next element after the current one we are on and freeing with the function, ipmi_free_recv_msg internally in this loop. Signed-off-by: Nicholas Krause <xerofoify@gmail.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
-rw-r--r--drivers/char/ipmi/ipmi_devintf.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
index ec318bf434a6..1786574536b2 100644
--- a/drivers/char/ipmi/ipmi_devintf.c
+++ b/drivers/char/ipmi/ipmi_devintf.c
@@ -157,12 +157,16 @@ static int ipmi_release(struct inode *inode, struct file *file)
{
struct ipmi_file_private *priv = file->private_data;
int rv;
+ struct ipmi_recv_msg *msg, *next;
rv = ipmi_destroy_user(priv->user);
if (rv)
return rv;
- /* FIXME - free the messages in the list. */
+ list_for_each_entry_safe(msg, next, &priv->recv_msgs, link)
+ ipmi_free_recv_msg(msg);
+
+
kfree(priv);
return 0;