upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-09 00:32:25 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

scmi: Avoid a use-after-free

Browse source 
Use LIST_FOREACH_SAFE to avoid a use-after-free in scmi_reqs_pool_free.
The next pointer will be invalid after the call to free meaning
LIST_FOREACH will dereference a freed struct to move to the next item.

Reviewed by:	emaste
Sponsored by:	Arm Ltd
Differential Revision:	https://reviews.freebsd.org/D50753
This commit is contained in:
Andrew Turner 2025-06-09 23:30:36 +01:00
parent 1254c42c68
commit d41a2ba73c
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
sys/dev/firmware/arm/scmi.c
View file

@ -291,9 +291,9 @@ scmi_reqs_pool_allocate(device_t dev, const int max_msg, const int max_payld_sz)
static void
scmi_reqs_pool_free(struct scmi_reqs_pool *rp)
{
struct scmi_req *req;
struct scmi_req *req, *tmp;
LIST_FOREACH(req, &rp->head, next) {
LIST_FOREACH_SAFE(req, &rp->head, next, tmp) {
mtx_destroy(&req->mtx);
free(req, M_DEVBUF);
}