From patchwork Thu Apr 2 05:29:56 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 15851 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n325gI9q004104 for ; Thu, 2 Apr 2009 05:42:19 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751864AbZDBFmS (ORCPT ); Thu, 2 Apr 2009 01:42:18 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1754235AbZDBFmS (ORCPT ); Thu, 2 Apr 2009 01:42:18 -0400 Received: from mail-ew0-f165.google.com ([209.85.219.165]:33119 "EHLO mail-ew0-f165.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751864AbZDBFmS (ORCPT ); Thu, 2 Apr 2009 01:42:18 -0400 Received: by ewy9 with SMTP id 9so367876ewy.37 for ; Wed, 01 Apr 2009 22:42:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:x-x-sender:to :subject:message-id:mime-version:content-type; bh=DubTfFONdH1O0p67E3fHt/p+0Mt7q4nh8fhxmJLPMo0=; b=Sq+5N9GGLqCDbJW4H6/urZrzdRzJ+5TLgRCreVIb5STqai8Bl2CRtQ7hYcDBxxYQtP gDzPJxedktCedQITMeZQKJsHOMwx2CoBOoKJA/mjWvH9dqXmL6Sx83faS8mhuboQIcOS FoymaeKVH3vg0WALXVHigIqFOgGtDyhjcMWic= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:x-x-sender:to:subject:message-id:mime-version :content-type; b=l+tXtNQFHtqU5laQ2dMIiIooOCUKFLOoh2zXL9OvzcfuVkQOrk1a7/1lVhGjJ2sNbX 7By26re6VzQPOXuOMYEhKdDf2kTwjeq4jQDx4bHKKtWyPY2Sg1CwAzfmNqgAC+0ssTfa 7qlEKUU/BTd9PdJDu94eA+KYCCYLCz+h5NhwY= Received: by 10.210.78.16 with SMTP id a16mr2496761ebb.28.1238650935137; Wed, 01 Apr 2009 22:42:15 -0700 (PDT) Received: from ?192.168.1.118? ([196.201.135.73]) by mx.google.com with ESMTPS id 5sm1047121eyh.41.2009.04.01.22.41.59 (version=TLSv1/SSLv3 cipher=RC4-MD5); Wed, 01 Apr 2009 22:42:14 -0700 (PDT) Date: Thu, 2 Apr 2009 08:29:56 +0300 (EAT) From: Dan Carpenter X-X-Sender: dcarpenter@usbsys.site To: shaohua.li@intel.com, linux-acpi@vger.kernel.org Subject: [patch] dereference after kfree() Message-ID: MIME-Version: 1.0 Sender: linux-acpi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-acpi@vger.kernel.org dock_remove() calls kfree() on dock_station so we should use list_for_each_entry_safe() to avoid dereferencing freed memory. Found by smatch (http://repo.or.cz/w/smatch.git/). Compile tested. regards, dan carpenter Signed-off-by: Dan Carpenter --- To unsubscribe from this list: send the line "unsubscribe linux-acpi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- orig/drivers/acpi/dock.c 2009-04-01 21:46:57.000000000 +0300 +++ devel/drivers/acpi/dock.c 2009-04-01 21:48:51.000000000 +0300 @@ -1146,9 +1146,10 @@ static void __exit dock_exit(void) { struct dock_station *dock_station; + struct dock_station *tmp; unregister_acpi_bus_notifier(&dock_acpi_notifier); - list_for_each_entry(dock_station, &dock_stations, sibiling) + list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling) dock_remove(dock_station); }