summaryrefslogtreecommitdiffstats
path: root/drivers/mfd/wm8350-irq.c
diff options
context:
space:
mode:
authorJulia Lawall <julia@diku.dk>2009-12-22 21:31:43 +0100
committerSamuel Ortiz <sameo@linux.intel.com>2010-03-07 22:16:55 +0100
commit0e820ab60118e06db62ef4e55b6dd96db807a34e (patch)
treeb2714e30224746ceea6d4e84acf9d8a33b09d300 /drivers/mfd/wm8350-irq.c
parentmfd: Use resouce_size for tc6393xb (diff)
downloadlinux-0e820ab60118e06db62ef4e55b6dd96db807a34e.tar.xz
linux-0e820ab60118e06db62ef4e55b6dd96db807a34e.zip
mfd: Correct use after free for t7l66xb
The structure t7l66xb should not be freed before the subsequent references to its fields in the arguments to clk_put. Furthermore, this structure is allocated near the beginning of the function, and a goto to the label err_noirq appears after a successful allocation, so it would seem that the kfree should be moved down below this label. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression x,e; identifier f; iterator I; statement S; @@ *kfree(x); ... when != &x when != x = e when != I(x,...) S *x->f // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk>
Diffstat (limited to 'drivers/mfd/wm8350-irq.c')
0 files changed, 0 insertions, 0 deletions