diff options
| author | Chris Bainbridge <chris.bainbridge@gmail.com> | 2015-04-22 02:25:36 +0300 |
|---|---|---|
| committer | Rafael J. Wysocki <rafael.j.wysocki@intel.com> | 2015-04-22 05:12:35 +0300 |
| commit | 6b5eab54691956b27669ce726cbd8ef2d8ec1e50 (patch) | |
| tree | c4f218c8e46dda321d0396bde5cb4e7a26ebd6a7 /Documentation | |
| parent | 0f5abd4020bfd2b1eec6975b91bd5068aa674a93 (diff) | |
| download | linux-6b5eab54691956b27669ce726cbd8ef2d8ec1e50.tar.xz | |
ACPI / EC: fix NULL pointer dereference in acpi_ec_remove_query_handler()
Use list_for_each_entry_safe for iterating because handler may be freed
in the loop.
BUG: unable to handle kernel NULL pointer dereference at 000000000000002c
IP: [<ffffffff814d69c8>] acpi_ec_put_query_handler+0x7/0x1a
Call Trace:
acpi_ec_remove_query_handler+0x87/0x97
acpi_smbus_hc_remove+0x2a/0x44 [sbshc]
acpi_device_remove+0x7b/0x9a
__device_release_driver+0x7e/0x110
driver_detach+0xb0/0xc0
bus_remove_driver+0x54/0xe0
driver_unregister+0x2b/0x60
acpi_bus_unregister_driver+0x10/0x12
acpi_smb_hc_driver_exit+0x10/0x12 [sbshc]
SyS_delete_module+0x1b8/0x210
system_call_fastpath+0x12/0x6a
Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Diffstat (limited to 'Documentation')
0 files changed, 0 insertions, 0 deletions