From patchwork Thu Apr 23 07:20:34 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Wright X-Patchwork-Id: 19487 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n3N7TTp5005336 for ; Thu, 23 Apr 2009 07:29:29 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755761AbZDWH23 (ORCPT ); Thu, 23 Apr 2009 03:28:29 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1755735AbZDWH22 (ORCPT ); Thu, 23 Apr 2009 03:28:28 -0400 Received: from sous-sol.org ([216.99.217.87]:48343 "EHLO x200.localdomain" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1755646AbZDWH20 (ORCPT ); Thu, 23 Apr 2009 03:28:26 -0400 Received: from x200.localdomain (x200.localdomain [127.0.0.1]) by x200.localdomain (8.14.3/8.14.3) with ESMTP id n3N7MTHk025025; Thu, 23 Apr 2009 00:22:29 -0700 Received: (from chrisw@localhost) by x200.localdomain (8.14.3/8.14.3/Submit) id n3N7MNQU025020; Thu, 23 Apr 2009 00:22:23 -0700 X-Authentication-Warning: x200.localdomain: chrisw set sender to Chris Wright using -f Message-Id: <20090423072223.406830766@sous-sol.org> User-Agent: quilt/0.47-1 Date: Thu, 23 Apr 2009 00:20:34 -0700 From: Chris Wright To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , Willy Tarreau , Rodrigo Rubira Branco , Jake Edge , Eugene Teo , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Len Brown , linux-acpi@vger.kernel.org, Dan Carpenter , Len Brown Subject: [patch 014/100] dock: fix dereference after kfree() References: <20090423072020.428683652@sous-sol.org> Content-Disposition: inline; filename=dock-fix-dereference-after-kfree.patch Sender: linux-acpi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-acpi@vger.kernel.org -stable review patch. If anyone has any objections, please let us know. --------------------- From: Dan Carpenter upstream commit: f240729832dff3785104d950dad2d3ced4387f6d dock_remove() calls kfree() on dock_station so we should use list_for_each_entry_safe() to avoid dereferencing freed memory. Found by smatch (http://repo.or.cz/w/smatch.git/). Compile tested. Signed-off-by: Dan Carpenter Signed-off-by: Len Brown Signed-off-by: Chris Wright --- drivers/acpi/dock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- To unsubscribe from this list: send the line "unsubscribe linux-acpi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- a/drivers/acpi/dock.c +++ b/drivers/acpi/dock.c @@ -1146,9 +1146,10 @@ static int __init dock_init(void) static void __exit dock_exit(void) { struct dock_station *dock_station; + struct dock_station *tmp; unregister_acpi_bus_notifier(&dock_acpi_notifier); - list_for_each_entry(dock_station, &dock_stations, sibiling) + list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling) dock_remove(dock_station); }