From: Dan Carpenter Date: Wed, 5 Sep 2012 12:30:42 +0000 (+0300) Subject: x86, microcode, AMD: Fix use after free in free_cache() X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=2d297480037e1d9100ca504737820c1bf65db6c0;p=GitHub%2Fexynos8895%2Fandroid_kernel_samsung_universal8895.git x86, microcode, AMD: Fix use after free in free_cache() list_for_each_entry_reverse() dereferences the iterator, but we already freed it. I don't see a reason that this has to be done in reverse order so change it to use list_for_each_entry_safe(). Signed-off-by: Dan Carpenter Signed-off-by: Borislav Petkov --- diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c index 5511216b4434..7720ff5a9ee2 100644 --- a/arch/x86/kernel/microcode_amd.c +++ b/arch/x86/kernel/microcode_amd.c @@ -150,9 +150,9 @@ static void update_cache(struct ucode_patch *new_patch) static void free_cache(void) { - struct ucode_patch *p; + struct ucode_patch *p, *tmp; - list_for_each_entry_reverse(p, &pcache, plist) { + list_for_each_entry_safe(p, tmp, &pcache, plist) { __list_del(p->plist.prev, p->plist.next); kfree(p->data); kfree(p);