6LoWPAN: use the _safe version of list_for_each

When we kfree(entry) that causes a use-after-free bug so we have to
use list_for_each_entry_safe() safe here.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 8a9dbaa0434fbce4970a45669849d3ba4f460154..5dc04890e0c5fed14357fea2ea51210d7e55841f 100644 (file)
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -813,15 +813,17 @@ static void lowpan_dellink(struct net_device *dev, struct list_head *head)
        struct lowpan_dev_info *lowpan_dev = lowpan_dev_info(dev);
        struct net_device *real_dev = lowpan_dev->real_dev;
        struct lowpan_dev_record *entry;
+       struct lowpan_dev_record *tmp;
 
        ASSERT_RTNL();
 
        mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx);
-       list_for_each_entry(entry, &lowpan_devices, list)
+       list_for_each_entry_safe(entry, tmp, &lowpan_devices, list) {
                if (entry->ldev == dev) {
                        list_del(&entry->list);
                        kfree(entry);
                }
+       }
        mutex_unlock(&lowpan_dev_info(dev)->dev_list_mtx);
 
        mutex_destroy(&lowpan_dev_info(dev)->dev_list_mtx);