Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

ARM: dts: msm: Untrusted pointer dereference 

To avoid access of variable after being freed, using
list_first_entry_safe function to iterate over list
of given type, safe against removal of list entry.

Change-Id: I70611fddf3e9b80b1affa3e5235be24eac0d0a58
Signed-off-by: Monika Singh <monising@codeaurora.org>
This commit is contained in:
Monika Singh 2018-04-24 09:54:50 +05:30 committed by L R
parent 5cdcc6e3d8
commit 38e6900756
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/misc/qseecom.c
View File

@ -7843,15 +7843,14 @@ exit_unreg_chrdev_region:
static int qseecom_remove(struct platform_device *pdev)
{
struct qseecom_registered_kclient_list *kclient = NULL;
struct qseecom_registered_kclient_list *kclient_tmp = NULL;
unsigned long flags = 0;
int ret = 0;
spin_lock_irqsave(&qseecom.registered_kclient_list_lock, flags);
list_for_each_entry(kclient, &qseecom.registered_kclient_list_head,
list) {
if (!kclient)
goto exit_irqrestore;
list_for_each_entry_safe(kclient, kclient_tmp,
&qseecom.registered_kclient_list_head, list) {
/* Break the loop if client handle is NULL */
if (!kclient->handle)
@ -7873,7 +7872,7 @@ exit_free_kc_handle:
kzfree(kclient->handle);
exit_free_kclient:
kzfree(kclient);
exit_irqrestore:
spin_unlock_irqrestore(&qseecom.registered_kclient_list_lock, flags);
if (qseecom.qseos_version > QSEEE_VERSION_00)