diff options
| author | Adrian Bunk <bunk@stusta.de> | 2007-07-29 19:00:37 +0400 |
|---|---|---|
| committer | Len Brown <len.brown@intel.com> | 2007-08-04 06:28:11 +0400 |
| commit | 07ddf768d860bee7bd6581b7af3ce1009dbd05d0 (patch) | |
| tree | 10cf0995194067022b84149d8bc9e81ce29ac0da /drivers/acpi/ec.c | |
| parent | 7c010de7506954e973abfab5c5999c5a97f7a73e (diff) | |
| download | linux-07ddf768d860bee7bd6581b7af3ce1009dbd05d0.tar.xz | |
ACPI: EC: acpi_ec_remove(): fix use-after-free
This patch fixes an obvious use-after-free introduced by
commit 837012ede14a8fc088be3682c964da7fc6af026b.
Spotted by the Coverity checker.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Alexey Starikovskiy <astarikovskiy@suse.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to 'drivers/acpi/ec.c')
| -rw-r--r-- | drivers/acpi/ec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c index 71caa7d983a3..b649ac7122a5 100644 --- a/drivers/acpi/ec.c +++ b/drivers/acpi/ec.c @@ -730,14 +730,14 @@ static int acpi_ec_add(struct acpi_device *device) static int acpi_ec_remove(struct acpi_device *device, int type) { struct acpi_ec *ec; - struct acpi_ec_query_handler *handler; + struct acpi_ec_query_handler *handler, *tmp; if (!device) return -EINVAL; ec = acpi_driver_data(device); mutex_lock(&ec->lock); - list_for_each_entry(handler, &ec->list, node) { + list_for_each_entry_safe(handler, tmp, &ec->list, node) { list_del(&handler->node); kfree(handler); } |