]> git.karo-electronics.de Git - karo-tx-linux.git/commitdiff
dock: fix dereference after kfree()
authorDan Carpenter <error27@gmail.com>
Tue, 7 Apr 2009 03:56:46 +0000 (23:56 -0400)
committerChris Wright <chrisw@sous-sol.org>
Mon, 27 Apr 2009 17:36:52 +0000 (10:36 -0700)
upstream commit: f240729832dff3785104d950dad2d3ced4387f6d

dock_remove() calls kfree() on dock_station so we should use
list_for_each_entry_safe() to avoid dereferencing freed memory.

Found by smatch (http://repo.or.cz/w/smatch.git/).  Compile tested.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
drivers/acpi/dock.c

index 35094f230b1e339d2d969ca27cb89816c7d3d9de..8f62fa01a9c76f910d1c88d4245f18eeab995708 100644 (file)
@@ -1146,9 +1146,10 @@ static int __init dock_init(void)
 static void __exit dock_exit(void)
 {
        struct dock_station *dock_station;
+       struct dock_station *tmp;
 
        unregister_acpi_bus_notifier(&dock_acpi_notifier);
-       list_for_each_entry(dock_station, &dock_stations, sibiling)
+       list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling)
                dock_remove(dock_station);
 }