diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-10-29 17:10:57 +0100 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2014-10-30 17:23:25 +0100 |
| commit | daac197ca9966eca3a6b07600e579756a9a1d447 (patch) | |
| tree | 212e2d7b9c528aec7db71480ad1b253cbd902929 /net/bluetooth/6lowpan.c | |
| parent | mac802154: add basic support for monitor (diff) | |
| download | linux-daac197ca9966eca3a6b07600e579756a9a1d447.tar.xz linux-daac197ca9966eca3a6b07600e579756a9a1d447.zip | |
Bluetooth: 6lowpan: use after free in disconnect_devices()
This was accidentally changed from list_for_each_entry_safe() to
list_for_each_entry() so now it has a use after free bug. I've changed
it back.
Fixes: 90305829635d ('Bluetooth: 6lowpan: Converting rwlocks to use RCU')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net/bluetooth/6lowpan.c')
| -rw-r--r-- | net/bluetooth/6lowpan.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c index 7254bddaca2f..eef298d17452 100644 --- a/net/bluetooth/6lowpan.c +++ b/net/bluetooth/6lowpan.c @@ -1383,7 +1383,7 @@ static const struct file_operations lowpan_control_fops = { static void disconnect_devices(void) { - struct lowpan_dev *entry, *new_dev; + struct lowpan_dev *entry, *tmp, *new_dev; struct list_head devices; INIT_LIST_HEAD(&devices); @@ -1408,7 +1408,7 @@ static void disconnect_devices(void) rcu_read_unlock(); - list_for_each_entry(entry, &devices, list) { + list_for_each_entry_safe(entry, tmp, &devices, list) { ifdown(entry->netdev); BT_DBG("Unregistering netdev %s %p", entry->netdev->name, entry->netdev); |