From d47c0701f2250889970afa6b5af025ea0a02b3be Mon Sep 17 00:00:00 2001 From: Daniel Scally Date: Tue, 22 Nov 2022 15:34:19 +0000 Subject: lib: events: Use list_for_each_entry() instead of the _safe() version For the UVC_EVENT_STREAMOFF event, the callback frees _other_ events because it's closing down the pipe. The use of the _safe() version of the list iterator results in a use-after-free of those events because they're fetched before the callback that frees them. The _safe() version is unecessary here; no other callback's behaviour requires it. Reviewed-by: Kieran Bingham Signed-off-by: Daniel Scally Signed-off-by: Kieran Bingham --- lib/events.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/events.c b/lib/events.c index bb18f49..ff4b7ce 100644 --- a/lib/events.c +++ b/lib/events.c @@ -104,9 +104,8 @@ static void events_dispatch(struct events *events, const fd_set *rfds, const fd_set *wfds, const fd_set *efds) { struct event_fd *event; - struct event_fd *next; - list_for_each_entry_safe(event, next, &events->events, list) { + list_for_each_entry(event, &events->events, list) { if (event->type == EVENT_READ && FD_ISSET(event->fd, rfds)) event->callback(event->priv); -- cgit v1.2.3