korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-25 21:24:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

dmaengine: sun4i: fix unsafe list iteration

Browse Source 
Currently, sun4i_dma_free_contract iterates over lists and frees memory
as it goes through them, causing reads to recently freed memory to
be performed. Fix this by using the safe version of the iterator, so
freed memory is not referenced at all.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Emilio López <emilio@elopez.com.ar>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
This commit is contained in:
Emilio López 2015-09-13 17:15:53 -03:00 committed by Vinod Koul
parent 0b23a1ece9
commit 40482e64b0
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/dma/sun4i-dma.c
View File

@ -599,13 +599,13 @@ get_next_cyclic_promise(struct sun4i_dma_contract *contract)
static void sun4i_dma_free_contract(struct virt_dma_desc *vd) static void sun4i_dma_free_contract(struct virt_dma_desc *vd)
{ {
struct sun4i_dma_contract *contract = to_sun4i_dma_contract(vd); struct sun4i_dma_contract *contract = to_sun4i_dma_contract(vd);
struct sun4i_dma_promise *promise; struct sun4i_dma_promise *promise, *tmp;
/* Free all the demands and completed demands */ /* Free all the demands and completed demands */
list_for_each_entry(promise, &contract->demands, list) list_for_each_entry_safe(promise, tmp, &contract->demands, list)
kfree(promise); kfree(promise);
list_for_each_entry(promise, &contract->completed_demands, list) list_for_each_entry_safe(promise, tmp, &contract->completed_demands, list)
kfree(promise); kfree(promise);
kfree(contract); kfree(contract);