Commit e603d9d8 authored by Johannes Berg's avatar Johannes Berg Committed by John W. Linville
Browse files

mac80211_hwsim: fix use after free 



Once the "data" pointer is freed, we can't be iterating
to the next item in the list any more so we need to use
list_for_each_entry_safe with a temporary variable.

Signed-off-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 5d416351

drivers/net/wireless/mac80211_hwsim.c

+2 −2
Original line number Diff line number Diff line
@@ -709,7 +709,7 @@ static const struct ieee80211_ops mac80211_hwsim_ops = 
static void mac80211_hwsim_free(void)

{

	struct list_head tmplist, *i, *tmp;

	struct mac80211_hwsim_data *data;

	struct mac80211_hwsim_data *data, *tmpdata;



	INIT_LIST_HEAD(&tmplist);
@@ -718,7 +718,7 @@ static void mac80211_hwsim_free(void) 
		list_move(i, &tmplist);

	spin_unlock_bh(&hwsim_radio_lock);



	list_for_each_entry(data, &tmplist, list) {

	list_for_each_entry_safe(data, tmpdata, &tmplist, list) {

		debugfs_remove(data->debugfs_group);

		debugfs_remove(data->debugfs_ps);

		debugfs_remove(data->debugfs);

CRA Git | Maintained and supported by SUSTech CRA and CCSE