dcb: use after free in dcb_flushapp()

[pandora-kernel.git] / net / dcb / dcbnl.c

diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 4323bd4..d900ab9 100644 (file)
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -1643,9 +1643,10 @@ EXPORT_SYMBOL(dcb_setapp);
 static void dcb_flushapp(void)
 {
        struct dcb_app_type *app;
+       struct dcb_app_type *tmp;
 
        spin_lock(&dcb_lock);
-       list_for_each_entry(app, &dcb_app_list, list) {
+       list_for_each_entry_safe(app, tmp, &dcb_app_list, list) {
                list_del(&app->list);
                kfree(app);
        }