diff options
author | Julia Lawall <Julia.Lawall@lip6.fr> | 2012-10-20 20:52:05 -0400 |
---|---|---|
committer | Benjamin Herrenschmidt <benh@kernel.crashing.org> | 2012-11-14 21:00:11 -0500 |
commit | bc26957c6cd913eaec9aac4ce17953efc1582c2e (patch) | |
tree | 71465953ddac16da6a46251fcf7bfac72f837a6c /arch/powerpc/kernel | |
parent | 490e078d6a21aa90d54f36cdcc544e87070175bd (diff) |
powerpc/rtas_flash: Eliminate possible double free
The function initialize_flash_pde_data is only called four times. All four
calls are in the function rtas_flash_init, and on the failure of any of the
calls, remove_flash_pde is called on the third argument of each of the
calls. There is thus no need for initialize_flash_pde_data to call
remove_flash_pde on the same argument. remove_flash_pde kfrees the data
field of its argument, and does not clear that field, so this amounts ot a
possible double free.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@
f(ps,T a,...) {
... when any
when != a = e
if(...) { ... free(a); ... return ...; }
... when any
}
@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@
* x = f(xs,a,...);
if (...) { ... free(a); ... return ...; }
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Diffstat (limited to 'arch/powerpc/kernel')
-rw-r--r-- | arch/powerpc/kernel/rtas_flash.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c index 20b0120db0c3..8329190312c1 100644 --- a/arch/powerpc/kernel/rtas_flash.c +++ b/arch/powerpc/kernel/rtas_flash.c | |||
@@ -650,10 +650,8 @@ static int initialize_flash_pde_data(const char *rtas_call_name, | |||
650 | int token; | 650 | int token; |
651 | 651 | ||
652 | dp->data = kzalloc(buf_size, GFP_KERNEL); | 652 | dp->data = kzalloc(buf_size, GFP_KERNEL); |
653 | if (dp->data == NULL) { | 653 | if (dp->data == NULL) |
654 | remove_flash_pde(dp); | ||
655 | return -ENOMEM; | 654 | return -ENOMEM; |
656 | } | ||
657 | 655 | ||
658 | /* | 656 | /* |
659 | * This code assumes that the status int is the first member of the | 657 | * This code assumes that the status int is the first member of the |