From 68050eb6c611527232fe5574c7306e97e47499ef Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 18 Nov 2016 14:34:10 +0300 Subject: mailbox: tegra-hsp: Use after free in tegra_hsp_remove_doorbells() We have to use the _safe version of list_for_each() because we're freeing the pointer as we go along. (This might not show up testing depending on what config options you have enabled). Fixes: 0fe88461a0ec ("mailbox: Add Tegra HSP driver") Signed-off-by: Dan Carpenter Signed-off-by: Thierry Reding --- drivers/mailbox/tegra-hsp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/mailbox/tegra-hsp.c') diff --git a/drivers/mailbox/tegra-hsp.c b/drivers/mailbox/tegra-hsp.c index 3724f2fcd371..0cde356c11ab 100644 --- a/drivers/mailbox/tegra-hsp.c +++ b/drivers/mailbox/tegra-hsp.c @@ -334,12 +334,12 @@ static struct mbox_chan *of_tegra_hsp_xlate(struct mbox_controller *mbox, static void tegra_hsp_remove_doorbells(struct tegra_hsp *hsp) { - struct tegra_hsp_doorbell *db; + struct tegra_hsp_doorbell *db, *tmp; unsigned long flags; spin_lock_irqsave(&hsp->lock, flags); - list_for_each_entry(db, &hsp->doorbells, list) + list_for_each_entry_safe(db, tmp, &hsp->doorbells, list) __tegra_hsp_doorbell_destroy(db); spin_unlock_irqrestore(&hsp->lock, flags); -- cgit v1.2.3