From: Alexander Nyberg Need to use list_for_entry_safe(), as we're removing items during the traversal. list_for_each_entry() uses the first ptr also as an iterator, if you kfree() it slab takes it, might poison it and then you try to use it to iterate to the next object in list. Cc: Vojtech Pavlik Signed-off-by: Andrew Morton --- drivers/input/gameport/ns558.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff -puN drivers/input/gameport/ns558.c~ns558-list-handling-fix drivers/input/gameport/ns558.c --- devel/drivers/input/gameport/ns558.c~ns558-list-handling-fix 2005-08-06 15:21:19.000000000 -0700 +++ devel-akpm/drivers/input/gameport/ns558.c 2005-08-06 15:21:19.000000000 -0700 @@ -275,9 +275,9 @@ static int __init ns558_init(void) static void __exit ns558_exit(void) { - struct ns558 *ns558; + struct ns558 *ns558, *safe; - list_for_each_entry(ns558, &ns558_list, node) { + list_for_each_entry_safe(ns558, safe, &ns558_list, node) { gameport_unregister_port(ns558->gameport); release_region(ns558->io & ~(ns558->size - 1), ns558->size); kfree(ns558); _