aboutsummaryrefslogtreecommitdiff
path: root/drivers/acpi
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2009-04-02 08:29:56 +0300
committerLen Brown <len.brown@intel.com>2009-04-03 12:48:59 -0400
commitf240729832dff3785104d950dad2d3ced4387f6d (patch)
tree8dff01796a28e04641691e110b481fbef592bde1 /drivers/acpi
parent5b4c0b6fffb91b07a6f85dabbdfbd5abab61d9db (diff)
dock: fix dereference after kfree()
dock_remove() calls kfree() on dock_station so we should use list_for_each_entry_safe() to avoid dereferencing freed memory. Found by smatch (http://repo.or.cz/w/smatch.git/). Compile tested. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to 'drivers/acpi')
-rw-r--r--drivers/acpi/dock.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index 35094f230b1..8f62fa01a9c 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -1146,9 +1146,10 @@ static int __init dock_init(void)
static void __exit dock_exit(void)
{
struct dock_station *dock_station;
+ struct dock_station *tmp;
unregister_acpi_bus_notifier(&dock_acpi_notifier);
- list_for_each_entry(dock_station, &dock_stations, sibiling)
+ list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling)
dock_remove(dock_station);
}