lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

x86, microcode, AMD: Fix use after free in free_cache()

Browse Source 
list_for_each_entry_reverse() dereferences the iterator, but we already
freed it. I don't see a reason that this has to be done in reverse order
so change it to use list_for_each_entry_safe().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
This commit is contained in:
Dan Carpenter
2012-09-05 15:30:42 +03:00
committed by Borislav Petkov
parent 2efb05e8e9
commit 2d29748003
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
arch/x86/kernel/microcode_amd.c
View File

@@ -150,9 +150,9 @@ static void update_cache(struct ucode_patch *new_patch)
static void free_cache(void) static void free_cache(void)
{ {
struct ucode_patch *p; struct ucode_patch *p, *tmp;
list_for_each_entry_reverse(p, &pcache, plist) { list_for_each_entry_safe(p, tmp, &pcache, plist) {
__list_del(p->plist.prev, p->plist.next); __list_del(p->plist.prev, p->plist.next);
kfree(p->data); kfree(p->data);
kfree(p); kfree(p);