diff options
| author | Julia Lawall <julia@diku.dk> | 2009-12-22 21:31:43 +0100 |
|---|---|---|
| committer | Samuel Ortiz <sameo@linux.intel.com> | 2010-03-07 22:16:55 +0100 |
| commit | 0e820ab60118e06db62ef4e55b6dd96db807a34e (patch) | |
| tree | b2714e30224746ceea6d4e84acf9d8a33b09d300 /drivers | |
| parent | mfd: Use resouce_size for tc6393xb (diff) | |
| download | linux-0e820ab60118e06db62ef4e55b6dd96db807a34e.tar.xz linux-0e820ab60118e06db62ef4e55b6dd96db807a34e.zip | |
mfd: Correct use after free for t7l66xb
The structure t7l66xb should not be freed before the subsequent references
to its fields in the arguments to clk_put. Furthermore, this structure is
allocated near the beginning of the function, and a goto to the label
err_noirq appears after a successful allocation, so it would seem that the
kfree should be moved down below this label.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
expression x,e;
identifier f;
iterator I;
statement S;
@@
*kfree(x);
... when != &x
when != x = e
when != I(x,...) S
*x->f
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Diffstat (limited to '')
| -rw-r--r-- | drivers/mfd/t7l66xb.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c index e0bbddd7aac2..26d9176fca91 100644 --- a/drivers/mfd/t7l66xb.c +++ b/drivers/mfd/t7l66xb.c @@ -403,12 +403,12 @@ static int t7l66xb_probe(struct platform_device *dev) err_ioremap: release_resource(&t7l66xb->rscr); err_request_scr: - kfree(t7l66xb); clk_put(t7l66xb->clk48m); err_clk48m_get: clk_put(t7l66xb->clk32k); err_clk32k_get: err_noirq: + kfree(t7l66xb); return ret; } |