Commit f2407298 authored by Dan Carpenter's avatar Dan Carpenter Committed by Len Brown

dock: fix dereference after kfree()

dock_remove() calls kfree() on dock_station so we should use
list_for_each_entry_safe() to avoid dereferencing freed memory.

Found by smatch (http://repo.or.cz/w/smatch.git/).  Compile tested.
Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarLen Brown <len.brown@intel.com>
parent 5b4c0b6f
...@@ -1146,9 +1146,10 @@ static int __init dock_init(void) ...@@ -1146,9 +1146,10 @@ static int __init dock_init(void)
static void __exit dock_exit(void) static void __exit dock_exit(void)
{ {
struct dock_station *dock_station; struct dock_station *dock_station;
struct dock_station *tmp;
unregister_acpi_bus_notifier(&dock_acpi_notifier); unregister_acpi_bus_notifier(&dock_acpi_notifier);
list_for_each_entry(dock_station, &dock_stations, sibiling) list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling)
dock_remove(dock_station); dock_remove(dock_station);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment