From 1544fdbc857cbe8afca16a521d3254346befeb06 Mon Sep 17 00:00:00 2001 From: Adrian Bunk Date: Wed, 24 Oct 2007 18:26:00 +0200 Subject: ACPI: EC: fix use-after-free This patch fixes a use-after-free introduced by commit 30c08574da0ead1a47797ce028218ce5b2de61c7 (ACPI: EC: Add new query handler to list head) Spotted by the Coverity checker. Signed-off-by: Adrian Bunk Acked-by: Alexey Starikovskiy Signed-off-by: Len Brown --- drivers/acpi/ec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/acpi/ec.c') diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c index bf60b24ebf5..06b78e5e33a 100644 --- a/drivers/acpi/ec.c +++ b/drivers/acpi/ec.c @@ -445,9 +445,9 @@ EXPORT_SYMBOL_GPL(acpi_ec_add_query_handler); void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit) { - struct acpi_ec_query_handler *handler; + struct acpi_ec_query_handler *handler, *tmp; mutex_lock(&ec->lock); - list_for_each_entry(handler, &ec->list, node) { + list_for_each_entry_safe(handler, tmp, &ec->list, node) { if (query_bit == handler->query_bit) { list_del(&handler->node); kfree(handler); -- cgit v1.2.3