https://github.com/torvalds/linux
Revision d04d01b113be5b88418eb30087753c3de0a39fd8 authored by Michael S. Tsirkin on 22 March 2007, 21:40:16 UTC, committed by Roland Dreier on 22 March 2007, 21:40:16 UTC
The connected mode code added the possibility that an neigh struct
gets freed in the list_for_each_entry() loop in path_rec_completion(),
which causes a use-after-free.  Fix this by changing to the _safe
variant of the list walking macro.

This was spotted by the Coverity checker (CID 1567).

Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
1 parent 73b9e98
History
Tip revision: d04d01b113be5b88418eb30087753c3de0a39fd8 authored by Michael S. Tsirkin on 22 March 2007, 21:40:16 UTC
IPoIB: Fix use-after-free in path_rec_completion()
Tip revision: d04d01b
File Mode Size
Documentation
arch
block
crypto
drivers
fs
include
init
ipc
kernel
lib
mm
net
scripts
security
sound
usr
.gitignore -rw-r--r-- 572 bytes
.mailmap -rw-r--r-- 3.5 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 88.9 KB
Kbuild -rw-r--r-- 1.2 KB
MAINTAINERS -rw-r--r-- 82.0 KB
Makefile -rw-r--r-- 49.1 KB
README -rw-r--r-- 16.5 KB
REPORTING-BUGS -rw-r--r-- 3.0 KB

README

back to top