rapidio: fix use after free in rio_unregister_scan()

[~andy/linux] / drivers / rapidio / rio.c

diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
index f4f30af2df68c682744cc125ede61da5f87eb4d1..2e8a20cac58848cdd0e2afa6201f3f82f4a88e84 100644 (file)
--- a/drivers/rapidio/rio.c
+++ b/drivers/rapidio/rio.c
@@ -1715,11 +1715,13 @@ int rio_unregister_scan(int mport_id, struct rio_scan *scan_ops)
                    (mport_id == RIO_MPORT_ANY && port->nscan == scan_ops))
                        port->nscan = NULL;
 
-       list_for_each_entry(scan, &rio_scans, node)
+       list_for_each_entry(scan, &rio_scans, node) {
                if (scan->mport_id == mport_id) {
                        list_del(&scan->node);
                        kfree(scan);
+                       break;
                }
+       }
 
        mutex_unlock(&rio_mport_list_lock);