Commit 7cbd4877 authored by Dan Williams's avatar Dan Williams
Browse files

dmatest: fix use after free in dmatest_exit 



dmatest_cleanup_chanel will free dtc, so grab ->chan before it goes away
and use it to do the release.

Reported-by: default avatarThierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
parent c74ef1f8

drivers/dma/dmatest.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -430,13 +430,15 @@ late_initcall(dmatest_init); 
static void __exit dmatest_exit(void)

static void __exit dmatest_exit(void)

{

{

	struct dmatest_chan *dtc, *_dtc;

	struct dmatest_chan *dtc, *_dtc;

	struct dma_chan *chan;





	list_for_each_entry_safe(dtc, _dtc, &dmatest_channels, node) {

	list_for_each_entry_safe(dtc, _dtc, &dmatest_channels, node) {

		list_del(&dtc->node);

		list_del(&dtc->node);

		chan = dtc->chan;

		dmatest_cleanup_channel(dtc);

		dmatest_cleanup_channel(dtc);

		pr_debug("dmatest: dropped channel %s\n",

		pr_debug("dmatest: dropped channel %s\n",

			 dma_chan_name(dtc->chan));

			 dma_chan_name(chan));

		dma_release_channel(dtc->chan);

		dma_release_channel(chan);

	}

	}

}

}

module_exit(dmatest_exit);

module_exit(dmatest_exit);