aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/scsi/ses.c
diff options
context:
space:
mode:
authorJulia Lawall <julia@diku.dk>2010-03-10 18:20:42 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2010-03-12 18:52:28 -0500
commit9b3a6549b2602ca30f58715a0071e29f9898cae9 (patch)
tree8709822f0018f55a7e542ca9c0755d99f5226b4f /drivers/scsi/ses.c
parent2d30a1f6315b8940537e8e98882c6038fbac9ba5 (diff)
drivers/scsi/ses.c: eliminate double free
The few lines below the kfree of hdr_buf may go to the label err_free which will also free hdr_buf. The most straightforward solution seems to be to just move the kfree of hdr_buf after these gotos. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @r@ identifier E; expression E1; iterator I; statement S; @@ *kfree(E); ... when != E = E1 when != I(E,...) S when != &E *kfree(E); // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Cc: James Bottomley <James.Bottomley@HansenPartnership.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/scsi/ses.c')
-rw-r--r--drivers/scsi/ses.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 1d7a8780e00c..0d9d6f7567f5 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -595,8 +595,6 @@ static int ses_intf_add(struct device *cdev,
595 ses_dev->page10_len = len; 595 ses_dev->page10_len = len;
596 buf = NULL; 596 buf = NULL;
597 } 597 }
598 kfree(hdr_buf);
599
600 scomp = kzalloc(sizeof(struct ses_component) * components, GFP_KERNEL); 598 scomp = kzalloc(sizeof(struct ses_component) * components, GFP_KERNEL);
601 if (!scomp) 599 if (!scomp)
602 goto err_free; 600 goto err_free;
@@ -608,6 +606,8 @@ static int ses_intf_add(struct device *cdev,
608 goto err_free; 606 goto err_free;
609 } 607 }
610 608
609 kfree(hdr_buf);
610
611 edev->scratch = ses_dev; 611 edev->scratch = ses_dev;
612 for (i = 0; i < components; i++) 612 for (i = 0; i < components; i++)
613 edev->component[i].scratch = scomp + i; 613 edev->component[i].scratch = scomp + i;