diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-09-05 15:30:42 +0300 |
|---|---|---|
| committer | Borislav Petkov <borislav.petkov@amd.com> | 2012-09-19 18:06:25 +0200 |
| commit | 2d297480037e1d9100ca504737820c1bf65db6c0 (patch) | |
| tree | 69f7a75359909a6d71a0dfa1ca96fc8f0e7e1b67 /arch/x86 | |
| parent | 2efb05e8e9fa3510044e007b90263c73b6a83f84 (diff) | |
| download | op-kernel-dev-2d297480037e1d9100ca504737820c1bf65db6c0.zip op-kernel-dev-2d297480037e1d9100ca504737820c1bf65db6c0.tar.gz | |
x86, microcode, AMD: Fix use after free in free_cache()
list_for_each_entry_reverse() dereferences the iterator, but we already
freed it. I don't see a reason that this has to be done in reverse order
so change it to use list_for_each_entry_safe().
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
Diffstat (limited to 'arch/x86')
| -rw-r--r-- | arch/x86/kernel/microcode_amd.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c index 5511216..7720ff5 100644 --- a/arch/x86/kernel/microcode_amd.c +++ b/arch/x86/kernel/microcode_amd.c @@ -150,9 +150,9 @@ static void update_cache(struct ucode_patch *new_patch) static void free_cache(void) { - struct ucode_patch *p; + struct ucode_patch *p, *tmp; - list_for_each_entry_reverse(p, &pcache, plist) { + list_for_each_entry_safe(p, tmp, &pcache, plist) { __list_del(p->plist.prev, p->plist.next); kfree(p->data); kfree(p); |
