diff options
author | Julia Lawall <julia@diku.dk> | 2009-12-22 21:31:43 +0100 |
---|---|---|
committer | Samuel Ortiz <sameo@linux.intel.com> | 2010-03-07 22:16:55 +0100 |
commit | 0e820ab60118e06db62ef4e55b6dd96db807a34e (patch) | |
tree | b2714e30224746ceea6d4e84acf9d8a33b09d300 /drivers/dma/shdma.h | |
parent | 1ecc09e765d3ae16ef42a4d454836d9ed804fd18 (diff) | |
download | op-kernel-dev-0e820ab60118e06db62ef4e55b6dd96db807a34e.zip op-kernel-dev-0e820ab60118e06db62ef4e55b6dd96db807a34e.tar.gz |
mfd: Correct use after free for t7l66xb
The structure t7l66xb should not be freed before the subsequent references
to its fields in the arguments to clk_put. Furthermore, this structure is
allocated near the beginning of the function, and a goto to the label
err_noirq appears after a successful allocation, so it would seem that the
kfree should be moved down below this label.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
expression x,e;
identifier f;
iterator I;
statement S;
@@
*kfree(x);
... when != &x
when != x = e
when != I(x,...) S
*x->f
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Diffstat (limited to 'drivers/dma/shdma.h')
0 files changed, 0 insertions, 0 deletions