Piteball/android_kernel_samsung_msm8226
1
0
Fork 0
mirror of https://github.com/S3NEO/android_kernel_samsung_msm8226.git synced 2024-11-07 03:47:13 +00:00
Code Issues Projects Releases Packages Wiki Activity

dmatest: fix use after free in dmatest_exit

Browse source 
dmatest_cleanup_chanel will free dtc, so grab ->chan before it goes away
and use it to do the release.

Reported-by: Thierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
This commit is contained in:
Dan Williams 2009-03-04 16:06:03 -07:00
parent c74ef1f867
commit 7cbd4877e5
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/dma/dmatest.c
View file

@ -430,13 +430,15 @@ late_initcall(dmatest_init);
static void __exit dmatest_exit(void) static void __exit dmatest_exit(void)
{ {
struct dmatest_chan *dtc, *_dtc; struct dmatest_chan *dtc, *_dtc;
struct dma_chan *chan;
list_for_each_entry_safe(dtc, _dtc, &dmatest_channels, node) { list_for_each_entry_safe(dtc, _dtc, &dmatest_channels, node) {
list_del(&dtc->node); list_del(&dtc->node);
chan = dtc->chan;
dmatest_cleanup_channel(dtc); dmatest_cleanup_channel(dtc);
pr_debug("dmatest: dropped channel %s\n", pr_debug("dmatest: dropped channel %s\n",
dma_chan_name(dtc->chan)); dma_chan_name(chan));
dma_release_channel(dtc->chan); dma_release_channel(chan);
} }
} }
module_exit(dmatest_exit); module_exit(dmatest_exit);