diff options
| author | Adrian Bunk <bunk@kernel.org> | 2007-10-24 18:26:00 +0200 |
|---|---|---|
| committer | Len Brown <len.brown@intel.com> | 2007-10-25 22:38:02 +0200 |
| commit | 1544fdbc857cbe8afca16a521d3254346befeb06 (patch) | |
| tree | 6c4111911a0182293ef7a40f90b1196876795625 /drivers | |
| parent | ACPI: battery: remove dead code (diff) | |
| download | linux-1544fdbc857cbe8afca16a521d3254346befeb06.tar.xz linux-1544fdbc857cbe8afca16a521d3254346befeb06.zip | |
ACPI: EC: fix use-after-free
This patch fixes a use-after-free introduced by
commit 30c08574da0ead1a47797ce028218ce5b2de61c7
(ACPI: EC: Add new query handler to list head)
Spotted by the Coverity checker.
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Acked-by: Alexey Starikovskiy <astarikovskiy@suse.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/acpi/ec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c index bf60b24ebf54..06b78e5e33a1 100644 --- a/drivers/acpi/ec.c +++ b/drivers/acpi/ec.c @@ -445,9 +445,9 @@ EXPORT_SYMBOL_GPL(acpi_ec_add_query_handler); void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit) { - struct acpi_ec_query_handler *handler; + struct acpi_ec_query_handler *handler, *tmp; mutex_lock(&ec->lock); - list_for_each_entry(handler, &ec->list, node) { + list_for_each_entry_safe(handler, tmp, &ec->list, node) { if (query_bit == handler->query_bit) { list_del(&handler->node); kfree(handler); |