summaryrefslogtreecommitdiff
path: root/drivers/rapidio
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2013-07-31 13:53:34 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2013-07-31 14:41:02 -0700
commitf93f3c4ee48727713c3349b659adf8048fd4524b (patch)
tree28f871e0aad6131c5c3d9297f3fa7fb202363018 /drivers/rapidio
parent4e5052948110140f1628dd986e27912b0e6b2065 (diff)
rapidio: fix use after free in rio_unregister_scan()
We're freeing the list iterator so we can't move to the next entry. Since there is only one matching mport_id, we can just break after finding it. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Ryan Mallon <rmallon@gmail.com> Acked-by: Alexandre Bounine <alexandre.bounine@idt.com> Cc: Matt Porter <mporter@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/rapidio')
-rw-r--r--drivers/rapidio/rio.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
index f4f30af2df68..2e8a20cac588 100644
--- a/drivers/rapidio/rio.c
+++ b/drivers/rapidio/rio.c
@@ -1715,11 +1715,13 @@ int rio_unregister_scan(int mport_id, struct rio_scan *scan_ops)
(mport_id == RIO_MPORT_ANY && port->nscan == scan_ops))
port->nscan = NULL;
- list_for_each_entry(scan, &rio_scans, node)
+ list_for_each_entry(scan, &rio_scans, node) {
if (scan->mport_id == mport_id) {
list_del(&scan->node);
kfree(scan);
+ break;
}
+ }
mutex_unlock(&rio_mport_list_lock);