From 7e5bd54a1f40a21f7d7413b55a1072b852dfd3f1 Mon Sep 17 00:00:00 2001 From: Adrian Bunk Date: Sun, 29 Jul 2007 17:00:37 +0200 Subject: [PATCH] ACPI: EC: acpi_ec_remove(): fix use-after-free This patch fixes an obvious use-after-free introduced by commit f2780961d71c8fb0830e3aeec0562a639e6559d3. Spotted by the Coverity checker. Signed-off-by: Adrian Bunk Acked-by: Alexey Starikovskiy Signed-off-by: Len Brown --- drivers/acpi/ec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c index 71caa7d983a3c..b649ac7122a51 100644 --- a/drivers/acpi/ec.c +++ b/drivers/acpi/ec.c @@ -730,14 +730,14 @@ static int acpi_ec_add(struct acpi_device *device) static int acpi_ec_remove(struct acpi_device *device, int type) { struct acpi_ec *ec; - struct acpi_ec_query_handler *handler; + struct acpi_ec_query_handler *handler, *tmp; if (!device) return -EINVAL; ec = acpi_driver_data(device); mutex_lock(&ec->lock); - list_for_each_entry(handler, &ec->list, node) { + list_for_each_entry_safe(handler, tmp, &ec->list, node) { list_del(&handler->node); kfree(handler); } -- 2.39.5