Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f2407298 authored by Dan Carpenter's avatar Dan Carpenter Committed by Len Brown
Browse files

dock: fix dereference after kfree() 

dock_remove() calls kfree() on dock_station so we should use
list_for_each_entry_safe() to avoid dereferencing freed memory.

Found by smatch (http://repo.or.cz/w/smatch.git/

).  Compile tested.

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarLen Brown <len.brown@intel.com>
parent 5b4c0b6f

drivers/acpi/dock.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -1146,9 +1146,10 @@ static int __init dock_init(void) 
static void __exit dock_exit(void)

static void __exit dock_exit(void)

{

{

	struct dock_station *dock_station;

	struct dock_station *dock_station;

	struct dock_station *tmp;





	unregister_acpi_bus_notifier(&dock_acpi_notifier);

	unregister_acpi_bus_notifier(&dock_acpi_notifier);

	list_for_each_entry(dock_station, &dock_stations, sibiling)

	list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling)

		dock_remove(dock_station);

		dock_remove(dock_station);

}

}