summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorEmilio López <emilio@elopez.com.ar>2015-09-13 17:15:53 -0300
committerVinod Koul <vinod.koul@intel.com>2015-09-30 12:17:22 +0530
commit40482e64b0b84388561b00b880eeca7000f72d38 (patch)
tree7005e99333699a574292d34fee19dc10b16e0752 /drivers
parent0b23a1ece9be2c3e04c3b8d3594a1ada1fa1ae50 (diff)
dmaengine: sun4i: fix unsafe list iteration
Currently, sun4i_dma_free_contract iterates over lists and frees memory as it goes through them, causing reads to recently freed memory to be performed. Fix this by using the safe version of the iterator, so freed memory is not referenced at all. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Emilio López <emilio@elopez.com.ar> Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/dma/sun4i-dma.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/dma/sun4i-dma.c b/drivers/dma/sun4i-dma.c
index a1a500d96ff2..1661d518224a 100644
--- a/drivers/dma/sun4i-dma.c
+++ b/drivers/dma/sun4i-dma.c
@@ -599,13 +599,13 @@ get_next_cyclic_promise(struct sun4i_dma_contract *contract)
static void sun4i_dma_free_contract(struct virt_dma_desc *vd)
{
struct sun4i_dma_contract *contract = to_sun4i_dma_contract(vd);
- struct sun4i_dma_promise *promise;
+ struct sun4i_dma_promise *promise, *tmp;
/* Free all the demands and completed demands */
- list_for_each_entry(promise, &contract->demands, list)
+ list_for_each_entry_safe(promise, tmp, &contract->demands, list)
kfree(promise);
- list_for_each_entry(promise, &contract->completed_demands, list)
+ list_for_each_entry_safe(promise, tmp, &contract->completed_demands, list)
kfree(promise);
kfree(contract);