diff options
| author | Dan Carpenter <error27@gmail.com> | 2009-04-02 08:29:56 +0300 |
|---|---|---|
| committer | Len Brown <len.brown@intel.com> | 2009-04-03 12:48:59 -0400 |
| commit | f240729832dff3785104d950dad2d3ced4387f6d (patch) | |
| tree | 8dff01796a28e04641691e110b481fbef592bde1 /drivers/acpi/dock.c | |
| parent | 5b4c0b6fffb91b07a6f85dabbdfbd5abab61d9db (diff) | |
dock: fix dereference after kfree()
dock_remove() calls kfree() on dock_station so we should use
list_for_each_entry_safe() to avoid dereferencing freed memory.
Found by smatch (http://repo.or.cz/w/smatch.git/). Compile tested.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to 'drivers/acpi/dock.c')
| -rw-r--r-- | drivers/acpi/dock.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c index 35094f230b1e..8f62fa01a9c7 100644 --- a/drivers/acpi/dock.c +++ b/drivers/acpi/dock.c @@ -1146,9 +1146,10 @@ static int __init dock_init(void) static void __exit dock_exit(void) { struct dock_station *dock_station; + struct dock_station *tmp; unregister_acpi_bus_notifier(&dock_acpi_notifier); - list_for_each_entry(dock_station, &dock_stations, sibiling) + list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling) dock_remove(dock_station); } |