dock_remove() calls kfree() on dock_station so we should use list_for_each_entry_safe() to avoid dereferencing freed memory. Found by smatch (http://repo.or.cz/w/smatch.git/). Compile tested. regards, dan carpenter Signed-off-by: Dan Carpenter <error27@xxxxxxxxx> --- orig/drivers/acpi/dock.c 2009-04-01 21:46:57.000000000 +0300 +++ devel/drivers/acpi/dock.c 2009-04-01 21:48:51.000000000 +0300 @@ -1146,9 +1146,10 @@ static void __exit dock_exit(void) { struct dock_station *dock_station; + struct dock_station *tmp; unregister_acpi_bus_notifier(&dock_acpi_notifier); - list_for_each_entry(dock_station, &dock_stations, sibiling) + list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibiling) dock_remove(dock_station); } -- To unsubscribe from this list: send the line "unsubscribe linux-acpi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
