diff options
| author | Chris Bainbridge <chris.bainbridge@gmail.com> | 2015-04-21 23:25:36 (GMT) |
|---|---|---|
| committer | Rafael J. Wysocki <rafael.j.wysocki@intel.com> | 2015-04-22 02:12:35 (GMT) |
| commit | 6b5eab54691956b27669ce726cbd8ef2d8ec1e50 (patch) | |
| tree | c4f218c8e46dda321d0396bde5cb4e7a26ebd6a7 /drivers/acpi/ec.c | |
| parent | 0f5abd4020bfd2b1eec6975b91bd5068aa674a93 (diff) | |
| download | linux-6b5eab54691956b27669ce726cbd8ef2d8ec1e50.tar.xz | |
ACPI / EC: fix NULL pointer dereference in acpi_ec_remove_query_handler()
Use list_for_each_entry_safe for iterating because handler may be freed
in the loop.
BUG: unable to handle kernel NULL pointer dereference at 000000000000002c
IP: [<ffffffff814d69c8>] acpi_ec_put_query_handler+0x7/0x1a
Call Trace:
acpi_ec_remove_query_handler+0x87/0x97
acpi_smbus_hc_remove+0x2a/0x44 [sbshc]
acpi_device_remove+0x7b/0x9a
__device_release_driver+0x7e/0x110
driver_detach+0xb0/0xc0
bus_remove_driver+0x54/0xe0
driver_unregister+0x2b/0x60
acpi_bus_unregister_driver+0x10/0x12
acpi_smb_hc_driver_exit+0x10/0x12 [sbshc]
SyS_delete_module+0x1b8/0x210
system_call_fastpath+0x12/0x6a
Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Diffstat (limited to 'drivers/acpi/ec.c')
| -rw-r--r-- | drivers/acpi/ec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c index 220d640..5e8fed4 100644 --- a/drivers/acpi/ec.c +++ b/drivers/acpi/ec.c @@ -861,7 +861,7 @@ void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit) } } mutex_unlock(&ec->mutex); - list_for_each_entry(handler, &free_list, node) + list_for_each_entry_safe(handler, tmp, &free_list, node) acpi_ec_put_query_handler(handler); } EXPORT_SYMBOL_GPL(acpi_ec_remove_query_handler); |