diff options
author | Julia Lawall <julia@diku.dk> | 2009-12-22 20:31:43 (GMT) |
---|---|---|
committer | Samuel Ortiz <sameo@linux.intel.com> | 2010-03-07 21:16:55 (GMT) |
commit | 0e820ab60118e06db62ef4e55b6dd96db807a34e (patch) | |
tree | b2714e30224746ceea6d4e84acf9d8a33b09d300 /drivers/mfd/t7l66xb.c | |
parent | 1ecc09e765d3ae16ef42a4d454836d9ed804fd18 (diff) | |
download | linux-0e820ab60118e06db62ef4e55b6dd96db807a34e.tar.xz |
mfd: Correct use after free for t7l66xb
The structure t7l66xb should not be freed before the subsequent references
to its fields in the arguments to clk_put. Furthermore, this structure is
allocated near the beginning of the function, and a goto to the label
err_noirq appears after a successful allocation, so it would seem that the
kfree should be moved down below this label.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
expression x,e;
identifier f;
iterator I;
statement S;
@@
*kfree(x);
... when != &x
when != x = e
when != I(x,...) S
*x->f
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Diffstat (limited to 'drivers/mfd/t7l66xb.c')
-rw-r--r-- | drivers/mfd/t7l66xb.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c index e0bbddd..26d9176 100644 --- a/drivers/mfd/t7l66xb.c +++ b/drivers/mfd/t7l66xb.c @@ -403,12 +403,12 @@ static int t7l66xb_probe(struct platform_device *dev) err_ioremap: release_resource(&t7l66xb->rscr); err_request_scr: - kfree(t7l66xb); clk_put(t7l66xb->clk48m); err_clk48m_get: clk_put(t7l66xb->clk32k); err_clk32k_get: err_noirq: + kfree(t7l66xb); return ret; } |