diff options
| author | Monika Singh <monising@codeaurora.org> | 2018-04-24 09:54:50 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-06-18 22:20:55 -0700 |
| commit | ed7b89c970329073c0235d63b07c8b6513e55036 (patch) | |
| tree | 96451d30d6f998fd1b1d0bdc7fa6b620b6960697 | |
| parent | 2763b994a1a1145eb8d538b35e7bab5156e1e351 (diff) | |
ARM: dts: msm: Untrusted pointer dereference
To avoid access of variable after being freed, using
list_first_entry_safe function to iterate over list
of given type, safe against removal of list entry.
Change-Id: I70611fddf3e9b80b1affa3e5235be24eac0d0a58
Signed-off-by: Monika Singh <monising@codeaurora.org>
| -rw-r--r-- | drivers/misc/qseecom.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c index ce47780e5936..f0140e8bbe68 100644 --- a/drivers/misc/qseecom.c +++ b/drivers/misc/qseecom.c @@ -8729,6 +8729,7 @@ exit_unreg_chrdev_region: static int qseecom_remove(struct platform_device *pdev) { struct qseecom_registered_kclient_list *kclient = NULL; + struct qseecom_registered_kclient_list *kclient_tmp = NULL; unsigned long flags = 0; int ret = 0; int i; @@ -8738,10 +8739,8 @@ static int qseecom_remove(struct platform_device *pdev) atomic_set(&qseecom.qseecom_state, QSEECOM_STATE_NOT_READY); spin_lock_irqsave(&qseecom.registered_kclient_list_lock, flags); - list_for_each_entry(kclient, &qseecom.registered_kclient_list_head, - list) { - if (!kclient) - goto exit_irqrestore; + list_for_each_entry_safe(kclient, kclient_tmp, + &qseecom.registered_kclient_list_head, list) { /* Break the loop if client handle is NULL */ if (!kclient->handle) @@ -8765,7 +8764,7 @@ exit_free_kc_handle: kzfree(kclient->handle); exit_free_kclient: kzfree(kclient); -exit_irqrestore: + spin_unlock_irqrestore(&qseecom.registered_kclient_list_lock, flags); if (qseecom.qseos_version > QSEEE_VERSION_00) |