diff options
| author | Dan Carpenter <error27@gmail.com> | 2009-04-02 07:29:56 +0200 |
|---|---|---|
| committer | Len Brown <len.brown@intel.com> | 2009-04-03 18:48:59 +0200 |
| commit | f240729832dff3785104d950dad2d3ced4387f6d (patch) | |
| tree | 8dff01796a28e04641691e110b481fbef592bde1 | |
| parent | ACPI: update comment (diff) | |
| download | linux-f240729832dff3785104d950dad2d3ced4387f6d.tar.xz linux-f240729832dff3785104d950dad2d3ced4387f6d.zip | |
dock: fix dereference after kfree()
dock_remove() calls kfree() on dock_station so we should use
list_for_each_entry_safe() to avoid dereferencing freed memory.
Found by smatch (http://repo.or.cz/w/smatch.git/). Compile tested.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Len Brown <len.brown@intel.com>
| -rw-r--r-- | drivers/acpi/dock.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c index 35094f230b1e..8f62fa01a9c7 100644 --- a/drivers/acpi/dock.c +++ b/drivers/acpi/dock.c @@ -1146,9 +1146,10 @@ static int __init dock_init(void) static void __exit dock_exit(void) { struct dock_station *dock_station; + struct dock_station *tmp; unregister_acpi_bus_notifier(&dock_acpi_notifier); - list_for_each_entry(dock_station, &dock_stations, sibiling) + list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling) dock_remove(dock_station); } |