[PATCH] ns558 list handling fix

Need to use list_for_entry_safe(), as we're removing items during the
traversal.  list_for_each_entry() uses the first ptr also as an iterator, if
you kfree() it slab takes it, might poison it and then you try to use it to
iterate to the next object in list.

Cc: Vojtech Pavlik <vojtech@suse.cz>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/drivers/input/gameport/ns558.c b/drivers/input/gameport/ns558.c
index 1ab5f2dc8a2a4a8fde91f56847165fa39312d9a1..70f051894a3cfa4d50f5dda7268c6af26e63b96f 100644 (file)
--- a/drivers/input/gameport/ns558.c
+++ b/drivers/input/gameport/ns558.c
@@ -275,9 +275,9 @@ static int __init ns558_init(void)
 
 static void __exit ns558_exit(void)
 {
-       struct ns558 *ns558;
+       struct ns558 *ns558, *safe;
 
-       list_for_each_entry(ns558, &ns558_list, node) {
+       list_for_each_entry_safe(ns558, safe, &ns558_list, node) {
                gameport_unregister_port(ns558->gameport);
                release_region(ns558->io & ~(ns558->size - 1), ns558->size);
                kfree(ns558);