summaryrefslogtreecommitdiff
path: root/drivers/mailbox
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2016-11-18 14:34:10 +0300
committerThierry Reding <treding@nvidia.com>2016-11-18 14:32:13 +0100
commit68050eb6c611527232fe5574c7306e97e47499ef (patch)
tree268a1aa8b6f5250b1c637c3f049ed29baa3e6a0d /drivers/mailbox
parent0fe88461a0ec95a71950b4841f139a62ed63dc81 (diff)
downloadlinux-68050eb6c611527232fe5574c7306e97e47499ef.tar.gz
mailbox: tegra-hsp: Use after free in tegra_hsp_remove_doorbells()
We have to use the _safe version of list_for_each() because we're freeing the pointer as we go along. (This might not show up testing depending on what config options you have enabled). Fixes: 0fe88461a0ec ("mailbox: Add Tegra HSP driver") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
Diffstat (limited to 'drivers/mailbox')
-rw-r--r--drivers/mailbox/tegra-hsp.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/mailbox/tegra-hsp.c b/drivers/mailbox/tegra-hsp.c
index 3724f2fcd371..0cde356c11ab 100644
--- a/drivers/mailbox/tegra-hsp.c
+++ b/drivers/mailbox/tegra-hsp.c
@@ -334,12 +334,12 @@ static struct mbox_chan *of_tegra_hsp_xlate(struct mbox_controller *mbox,
static void tegra_hsp_remove_doorbells(struct tegra_hsp *hsp)
{
- struct tegra_hsp_doorbell *db;
+ struct tegra_hsp_doorbell *db, *tmp;
unsigned long flags;
spin_lock_irqsave(&hsp->lock, flags);
- list_for_each_entry(db, &hsp->doorbells, list)
+ list_for_each_entry_safe(db, tmp, &hsp->doorbells, list)
__tegra_hsp_doorbell_destroy(db);
spin_unlock_irqrestore(&hsp->lock, flags);