From 07ddf768d860bee7bd6581b7af3ce1009dbd05d0 Mon Sep 17 00:00:00 2001 From: Adrian Bunk Date: Sun, 29 Jul 2007 17:00:37 +0200 Subject: ACPI: EC: acpi_ec_remove(): fix use-after-free This patch fixes an obvious use-after-free introduced by commit 837012ede14a8fc088be3682c964da7fc6af026b. Spotted by the Coverity checker. Signed-off-by: Adrian Bunk Acked-by: Alexey Starikovskiy Signed-off-by: Len Brown --- drivers/acpi/ec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/acpi/ec.c') diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c index 71caa7d983a3..b649ac7122a5 100644 --- a/drivers/acpi/ec.c +++ b/drivers/acpi/ec.c @@ -730,14 +730,14 @@ static int acpi_ec_add(struct acpi_device *device) static int acpi_ec_remove(struct acpi_device *device, int type) { struct acpi_ec *ec; - struct acpi_ec_query_handler *handler; + struct acpi_ec_query_handler *handler, *tmp; if (!device) return -EINVAL; ec = acpi_driver_data(device); mutex_lock(&ec->lock); - list_for_each_entry(handler, &ec->list, node) { + list_for_each_entry_safe(handler, tmp, &ec->list, node) { list_del(&handler->node); kfree(handler); } -- cgit v1.2.3