* [2.6.23 regression fix] acpi_ec_remove(): fix use-after-free
@ 2007-07-29 15:00 Adrian Bunk
0 siblings, 0 replies; only message in thread
From: Adrian Bunk @ 2007-07-29 15:00 UTC (permalink / raw)
To: Alexey Starikovskiy, Len Brown
Cc: linux-acpi, linux-kernel, Michal Piotrowski
This patch fixes an obvious use-after-free introduced by
commit 837012ede14a8fc088be3682c964da7fc6af026b.
Spotted by the Coverity checker.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
---
--- linux-2.6.23-rc1-mm1/drivers/acpi/ec.c.old 2007-07-28 07:59:49.000000000 +0200
+++ linux-2.6.23-rc1-mm1/drivers/acpi/ec.c 2007-07-28 08:00:25.000000000 +0200
@@ -730,14 +730,14 @@
static int acpi_ec_remove(struct acpi_device *device, int type)
{
struct acpi_ec *ec;
- struct acpi_ec_query_handler *handler;
+ struct acpi_ec_query_handler *handler, *tmp;
if (!device)
return -EINVAL;
ec = acpi_driver_data(device);
mutex_lock(&ec->lock);
- list_for_each_entry(handler, &ec->list, node) {
+ list_for_each_entry_safe(handler, tmp, &ec->list, node) {
list_del(&handler->node);
kfree(handler);
}
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2007-07-29 15:13 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-07-29 15:00 [2.6.23 regression fix] acpi_ec_remove(): fix use-after-free Adrian Bunk
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox