summaryrefslogtreecommitdiff
path: root/arch/powerpc/kernel/rtas_flash.c
diff options
context:
space:
mode:
authorJulia Lawall <Julia.Lawall@lip6.fr>2012-10-21 00:52:05 +0000
committerBenjamin Herrenschmidt <benh@kernel.crashing.org>2012-11-15 13:00:11 +1100
commitbc26957c6cd913eaec9aac4ce17953efc1582c2e (patch)
tree71465953ddac16da6a46251fcf7bfac72f837a6c /arch/powerpc/kernel/rtas_flash.c
parent490e078d6a21aa90d54f36cdcc544e87070175bd (diff)
powerpc/rtas_flash: Eliminate possible double free
The function initialize_flash_pde_data is only called four times. All four calls are in the function rtas_flash_init, and on the failure of any of the calls, remove_flash_pde is called on the third argument of each of the calls. There is thus no need for initialize_flash_pde_data to call remove_flash_pde on the same argument. remove_flash_pde kfrees the data field of its argument, and does not clear that field, so this amounts ot a possible double free. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @r@ identifier f,free,a; parameter list[n] ps; type T; expression e; @@ f(ps,T a,...) { ... when any when != a = e if(...) { ... free(a); ... return ...; } ... when any } @@ identifier r.f,r.free; expression x,a; expression list[r.n] xs; @@ * x = f(xs,a,...); if (...) { ... free(a); ... return ...; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Diffstat (limited to 'arch/powerpc/kernel/rtas_flash.c')
-rw-r--r--arch/powerpc/kernel/rtas_flash.c4
1 files changed, 1 insertions, 3 deletions
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 20b0120db0c3..8329190312c1 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -650,10 +650,8 @@ static int initialize_flash_pde_data(const char *rtas_call_name,
int token;
dp->data = kzalloc(buf_size, GFP_KERNEL);
- if (dp->data == NULL) {
- remove_flash_pde(dp);
+ if (dp->data == NULL)
return -ENOMEM;
- }
/*
* This code assumes that the status int is the first member of the