x86, microcode, AMD: Fix use after free in free_cache()

list_for_each_entry_reverse() dereferences the iterator, but we already
freed it. I don't see a reason that this has to be done in reverse order
so change it to use list_for_each_entry_safe().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>

diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index 5511216b44341b817c4c9f6be2b0765e3a3c833c..7720ff5a9ee292a449ad13a9347e603def50df53 100644 (file)
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -150,9 +150,9 @@ static void update_cache(struct ucode_patch *new_patch)
 
 static void free_cache(void)
 {
-       struct ucode_patch *p;
+       struct ucode_patch *p, *tmp;
 
-       list_for_each_entry_reverse(p, &pcache, plist) {
+       list_for_each_entry_safe(p, tmp, &pcache, plist) {
                __list_del(p->plist.prev, p->plist.next);
                kfree(p->data);
                kfree(p);