2011-06-06 11:31:23

by Jamie Iles

Subject: [PATCH] crypto: picoxcell: fix possible invalid pointer dereference

The completion callback will free the request so we must remove it from
the completion list before calling the callback.

Cc: [email protected]
Cc: Herbert Xu <[email protected]>
Signed-off-by: Jamie Iles <[email protected]>
---
drivers/crypto/picoxcell_crypto.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/crypto/picoxcell_crypto.c b/drivers/crypto/picoxcell_crypto.c
index db7cb31..a1b4ca2 100644
--- a/drivers/crypto/picoxcell_crypto.c
+++ b/drivers/crypto/picoxcell_crypto.c
@@ -1267,8 +1267,8 @@ static void spacc_spacc_complete(unsigned long data)
spin_unlock_irqrestore(&engine->hw_lock, flags);

list_for_each_entry_safe(req, tmp, &completed, list) {
- req->complete(req);
list_del(&req->list);
+ req->complete(req);
}
}

--
1.7.4.1

2011-06-08 13:28:16

by Herbert Xu

Subject: Re: [PATCH] crypto: picoxcell: fix possible invalid pointer dereference

On Mon, Jun 06, 2011 at 12:31:17PM +0100, Jamie Iles wrote:
> The completion callback will free the request so we must remove it from
> the completion list before calling the callback.
>
> Cc: [email protected]
> Cc: Herbert Xu <[email protected]>
> Signed-off-by: Jamie Iles <[email protected]>

Patch applied. Thanks Jamie!
--
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt