lkml.org 
[lkml]   [2009]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 014/100] dock: fix dereference after kfree()
    -stable review patch.  If anyone has any objections, please let us know.
    ---------------------

    From: Dan Carpenter <error27@gmail.com>

    upstream commit: f240729832dff3785104d950dad2d3ced4387f6d

    dock_remove() calls kfree() on dock_station so we should use
    list_for_each_entry_safe() to avoid dereferencing freed memory.

    Found by smatch (http://repo.or.cz/w/smatch.git/). Compile tested.

    Signed-off-by: Dan Carpenter <error27@gmail.com>
    Signed-off-by: Len Brown <len.brown@intel.com>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    ---
    drivers/acpi/dock.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/acpi/dock.c
    +++ b/drivers/acpi/dock.c
    @@ -1146,9 +1146,10 @@ static int __init dock_init(void)
    static void __exit dock_exit(void)
    {
    struct dock_station *dock_station;
    + struct dock_station *tmp;

    unregister_acpi_bus_notifier(&dock_acpi_notifier);
    - list_for_each_entry(dock_station, &dock_stations, sibiling)
    + list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling)
    dock_remove(dock_station);
    }



    \
     
     \ /
      Last update: 2009-04-23 09:39    [W:4.319 / U:0.560 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site