diff options
| author | Maxin B John <maxin.john@gmail.com> | 2011-07-25 17:12:59 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2011-07-25 20:57:14 -0700 |
| commit | ae891a1b93bf62e9aaa116a7a71312375047fc9f (patch) | |
| tree | 83e821e818654da3e3443ecddd757665251db6e0 | |
| parent | 5190f0c030f46b3169205f34f6d9ef480fa39ef2 (diff) | |
| download | op-kernel-dev-ae891a1b93bf62e9aaa116a7a71312375047fc9f.zip op-kernel-dev-ae891a1b93bf62e9aaa116a7a71312375047fc9f.tar.gz | |
devres: fix possible use after free
devres uses the pointer value as key after it's freed, which is safe but
triggers spurious use-after-free warnings on some static analysis tools.
Rearrange code to avoid such warnings.
Signed-off-by: Maxin B. John <maxin.john@gmail.com>
Reviewed-by: Rolf Eike Beer <eike-kernel@sf-tec.de>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | kernel/irq/devres.c | 2 | ||||
| -rw-r--r-- | lib/devres.c | 2 | ||||
| -rw-r--r-- | mm/dmapool.c | 2 |
3 files changed, 3 insertions, 3 deletions
diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c index 1ef4ffc..bd8e788 100644 --- a/kernel/irq/devres.c +++ b/kernel/irq/devres.c @@ -87,8 +87,8 @@ void devm_free_irq(struct device *dev, unsigned int irq, void *dev_id) { struct irq_devres match_data = { irq, dev_id }; - free_irq(irq, dev_id); WARN_ON(devres_destroy(dev, devm_irq_release, devm_irq_match, &match_data)); + free_irq(irq, dev_id); } EXPORT_SYMBOL(devm_free_irq); diff --git a/lib/devres.c b/lib/devres.c index 6efddf5..7c0e953 100644 --- a/lib/devres.c +++ b/lib/devres.c @@ -79,9 +79,9 @@ EXPORT_SYMBOL(devm_ioremap_nocache); */ void devm_iounmap(struct device *dev, void __iomem *addr) { - iounmap(addr); WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match, (void *)addr)); + iounmap(addr); } EXPORT_SYMBOL(devm_iounmap); diff --git a/mm/dmapool.c b/mm/dmapool.c index 03bf3bb..fbb58e3 100644 --- a/mm/dmapool.c +++ b/mm/dmapool.c @@ -500,7 +500,7 @@ void dmam_pool_destroy(struct dma_pool *pool) { struct device *dev = pool->dev; - dma_pool_destroy(pool); WARN_ON(devres_destroy(dev, dmam_pool_release, dmam_pool_match, pool)); + dma_pool_destroy(pool); } EXPORT_SYMBOL(dmam_pool_destroy); |
