From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chris Wright Subject: [patch 014/100] dock: fix dereference after kfree() Date: Thu, 23 Apr 2009 00:20:34 -0700 Message-ID: <20090423072223.406830766@sous-sol.org> References: <20090423072020.428683652@sous-sol.org> Return-path: Received: from sous-sol.org ([216.99.217.87]:48343 "EHLO x200.localdomain" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1755646AbZDWH20 (ORCPT ); Thu, 23 Apr 2009 03:28:26 -0400 Content-Disposition: inline; filename=dock-fix-dereference-after-kfree.patch Sender: linux-acpi-owner@vger.kernel.org List-Id: linux-acpi@vger.kernel.org To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , Theodore Ts'o , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , Willy Tarreau , Rodrigo Rubira Branco , Jake Edge , Eugene Teo , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Len Brown , linux-acpi@vger.kernel.org, Dan Carpenter , Len Brown -stable review patch. If anyone has any objections, please let us know. --------------------- From: Dan Carpenter upstream commit: f240729832dff3785104d950dad2d3ced4387f6d dock_remove() calls kfree() on dock_station so we should use list_for_each_entry_safe() to avoid dereferencing freed memory. Found by smatch (http://repo.or.cz/w/smatch.git/). Compile tested. Signed-off-by: Dan Carpenter Signed-off-by: Len Brown Signed-off-by: Chris Wright --- drivers/acpi/dock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/acpi/dock.c +++ b/drivers/acpi/dock.c @@ -1146,9 +1146,10 @@ static int __init dock_init(void) static void __exit dock_exit(void) { struct dock_station *dock_station; + struct dock_station *tmp; unregister_acpi_bus_notifier(&dock_acpi_notifier); - list_for_each_entry(dock_station, &dock_stations, sibiling) + list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling) dock_remove(dock_station); }