aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/mfd/t7l66xb.c
diff options
context:
space:
mode:
authorJulia Lawall <julia@diku.dk>2009-12-22 15:31:43 -0500
committerSamuel Ortiz <sameo@linux.intel.com>2010-03-07 16:16:55 -0500
commit0e820ab60118e06db62ef4e55b6dd96db807a34e (patch)
treeb2714e30224746ceea6d4e84acf9d8a33b09d300 /drivers/mfd/t7l66xb.c
parent1ecc09e765d3ae16ef42a4d454836d9ed804fd18 (diff)
mfd: Correct use after free for t7l66xb
The structure t7l66xb should not be freed before the subsequent references to its fields in the arguments to clk_put. Furthermore, this structure is allocated near the beginning of the function, and a goto to the label err_noirq appears after a successful allocation, so it would seem that the kfree should be moved down below this label. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression x,e; identifier f; iterator I; statement S; @@ *kfree(x); ... when != &x when != x = e when != I(x,...) S *x->f // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk>
Diffstat (limited to 'drivers/mfd/t7l66xb.c')
-rw-r--r--drivers/mfd/t7l66xb.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c
index e0bbddd7aac2..26d9176fca91 100644
--- a/drivers/mfd/t7l66xb.c
+++ b/drivers/mfd/t7l66xb.c
@@ -403,12 +403,12 @@ static int t7l66xb_probe(struct platform_device *dev)
403err_ioremap: 403err_ioremap:
404 release_resource(&t7l66xb->rscr); 404 release_resource(&t7l66xb->rscr);
405err_request_scr: 405err_request_scr:
406 kfree(t7l66xb);
407 clk_put(t7l66xb->clk48m); 406 clk_put(t7l66xb->clk48m);
408err_clk48m_get: 407err_clk48m_get:
409 clk_put(t7l66xb->clk32k); 408 clk_put(t7l66xb->clk32k);
410err_clk32k_get: 409err_clk32k_get:
411err_noirq: 410err_noirq:
411 kfree(t7l66xb);
412 return ret; 412 return ret;
413} 413}
414 414