diff options
| author | Adrian Bunk <bunk@stusta.de> | 2007-07-29 17:00:37 +0200 |
|---|---|---|
| committer | Len Brown <len.brown@intel.com> | 2007-08-03 22:28:11 -0400 |
| commit | 07ddf768d860bee7bd6581b7af3ce1009dbd05d0 (patch) | |
| tree | 10cf0995194067022b84149d8bc9e81ce29ac0da /drivers/acpi/ec.c | |
| parent | 7c010de7506954e973abfab5c5999c5a97f7a73e (diff) | |
| download | op-kernel-dev-07ddf768d860bee7bd6581b7af3ce1009dbd05d0.zip op-kernel-dev-07ddf768d860bee7bd6581b7af3ce1009dbd05d0.tar.gz | |
ACPI: EC: acpi_ec_remove(): fix use-after-free
This patch fixes an obvious use-after-free introduced by
commit 837012ede14a8fc088be3682c964da7fc6af026b.
Spotted by the Coverity checker.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Alexey Starikovskiy <astarikovskiy@suse.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to 'drivers/acpi/ec.c')
| -rw-r--r-- | drivers/acpi/ec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c index 71caa7d..b649ac7 100644 --- a/drivers/acpi/ec.c +++ b/drivers/acpi/ec.c @@ -730,14 +730,14 @@ static int acpi_ec_add(struct acpi_device *device) static int acpi_ec_remove(struct acpi_device *device, int type) { struct acpi_ec *ec; - struct acpi_ec_query_handler *handler; + struct acpi_ec_query_handler *handler, *tmp; if (!device) return -EINVAL; ec = acpi_driver_data(device); mutex_lock(&ec->lock); - list_for_each_entry(handler, &ec->list, node) { + list_for_each_entry_safe(handler, tmp, &ec->list, node) { list_del(&handler->node); kfree(handler); } |
