diff mbox

dereference after kfree()

Message ID Pine.LNX.4.64.0904012151001.27705@usbsys.site (mailing list archive)
State Accepted
Headers show

Commit Message

Dan Carpenter April 2, 2009, 5:29 a.m. UTC
dock_remove() calls kfree() on dock_station so we should use 
list_for_each_entry_safe() to avoid dereferencing freed memory.

Found by smatch (http://repo.or.cz/w/smatch.git/).  Compile tested.

regards,
dan carpenter

Signed-off-by: Dan Carpenter <error27@gmail.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-acpi" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Len Brown April 3, 2009, 4:48 p.m. UTC | #1
applied
thanks,
Len Brown, Intel Open Source Technology Center
--
To unsubscribe from this list: send the line "unsubscribe linux-acpi" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

--- orig/drivers/acpi/dock.c	2009-04-01 21:46:57.000000000 +0300
+++ devel/drivers/acpi/dock.c	2009-04-01 21:48:51.000000000 +0300
@@ -1146,9 +1146,10 @@ 
 static void __exit dock_exit(void)
 {
 	struct dock_station *dock_station;
+	struct dock_station *tmp;
 
 	unregister_acpi_bus_notifier(&dock_acpi_notifier);
-	list_for_each_entry(dock_station, &dock_stations, sibiling)
+	list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling)
 		dock_remove(dock_station);
 }