diff options
| author | Dan Carpenter <error27@gmail.com> | 2009-04-06 23:56:46 -0400 |
|---|---|---|
| committer | Chris Wright <chrisw@sous-sol.org> | 2009-04-27 10:36:52 -0700 |
| commit | 538c7aac35f4282d7674c473f099b323b1e020dd (patch) | |
| tree | b3c802bf5035419055e7a5fcc7c6232a1b6c66ab /drivers | |
| parent | d930ec7bcd0c4ef7ce0e555fbd540c5ebcedc8bd (diff) | |
dock: fix dereference after kfree()
upstream commit: f240729832dff3785104d950dad2d3ced4387f6d
dock_remove() calls kfree() on dock_station so we should use
list_for_each_entry_safe() to avoid dereferencing freed memory.
Found by smatch (http://repo.or.cz/w/smatch.git/). Compile tested.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/acpi/dock.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c index 35094f230b1e..8f62fa01a9c7 100644 --- a/drivers/acpi/dock.c +++ b/drivers/acpi/dock.c @@ -1146,9 +1146,10 @@ static int __init dock_init(void) static void __exit dock_exit(void) { struct dock_station *dock_station; + struct dock_station *tmp; unregister_acpi_bus_notifier(&dock_acpi_notifier); - list_for_each_entry(dock_station, &dock_stations, sibiling) + list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling) dock_remove(dock_station); } |