diff options
| author | Hervé Boisse <herve.boisse@qorvo.com> | 2022-09-05 15:28:56 +0200 |
|---|---|---|
| committer | Victor Liu <victorliu@google.com> | 2022-11-30 22:24:19 +0000 |
| commit | 8d4c2eadca685573fa88b1396470986e851e6096 (patch) | |
| tree | f8a0e81506c10cd55d3c6d918488988804c7cff1 | |
| parent | 412fab7d3f516980b0bb6906ae4c39d7422fc297 (diff) | |
| download | uwb-8d4c2eadca685573fa88b1396470986e851e6096.tar.gz | |
dw3000: Fix use-after-free in debugfs cleanup
bug: 244738292
Change-Id: Id2eb39e051c78ce3cdc23131e123b70844dfc95d
Signed-off-by: Taha HAMDI <taha.hamdi@qorvo.com>
| -rw-r--r-- | kernel/drivers/net/ieee802154/dw3000_debugfs.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/kernel/drivers/net/ieee802154/dw3000_debugfs.c b/kernel/drivers/net/ieee802154/dw3000_debugfs.c index c2f6b2d..33b88c1 100644 --- a/kernel/drivers/net/ieee802154/dw3000_debugfs.c +++ b/kernel/drivers/net/ieee802154/dw3000_debugfs.c @@ -762,10 +762,12 @@ int dw3000_debugsfs_init(struct dw3000 *dw) */ void dw3000_debugfs_remove(struct dw3000 *dw) { - struct dw3000_debugfs_file *cur; - - list_for_each_entry (cur, &dw->debugfs.dbgfile_list, ll) { + while (!list_empty(&dw->debugfs.dbgfile_list)) { + struct dw3000_debugfs_file *cur = + list_first_entry(&dw->debugfs.dbgfile_list, + struct dw3000_debugfs_file, ll); debugfs_remove(cur->file); + list_del(&cur->ll); kfree(cur); } |