Commit bc26957c authored by Julia Lawall's avatar Julia Lawall Committed by Benjamin Herrenschmidt

powerpc/rtas_flash: Eliminate possible double free

The function initialize_flash_pde_data is only called four times.  All four
calls are in the function rtas_flash_init, and on the failure of any of the
calls, remove_flash_pde is called on the third argument of each of the
calls.  There is thus no need for initialize_flash_pde_data to call
remove_flash_pde on the same argument.  remove_flash_pde kfrees the data
field of its argument, and does not clear that field, so this amounts ot a
possible double free.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@

f(ps,T a,...) {
  ... when any
      when != a = e
  if(...) { ... free(a); ... return ...; }
  ... when any
}

@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@

* x = f(xs,a,...);
  if (...) { ... free(a); ... return ...; }
// </smpl>
Signed-off-by: default avatarJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
parent 490e078d
...@@ -650,10 +650,8 @@ static int initialize_flash_pde_data(const char *rtas_call_name, ...@@ -650,10 +650,8 @@ static int initialize_flash_pde_data(const char *rtas_call_name,
int token; int token;
dp->data = kzalloc(buf_size, GFP_KERNEL); dp->data = kzalloc(buf_size, GFP_KERNEL);
if (dp->data == NULL) { if (dp->data == NULL)
remove_flash_pde(dp);
return -ENOMEM; return -ENOMEM;
}
/* /*
* This code assumes that the status int is the first member of the * This code assumes that the status int is the first member of the
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment