summaryrefslogtreecommitdiffstats
path: root/drivers/mfd
diff options
context:
space:
mode:
authorJulia Lawall <julia@diku.dk>2009-12-22 21:31:43 +0100
committerSamuel Ortiz <sameo@linux.intel.com>2010-03-07 22:16:55 +0100
commit0e820ab60118e06db62ef4e55b6dd96db807a34e (patch)
treeb2714e30224746ceea6d4e84acf9d8a33b09d300 /drivers/mfd
parent1ecc09e765d3ae16ef42a4d454836d9ed804fd18 (diff)
downloadlinux-0e820ab60118e06db62ef4e55b6dd96db807a34e.tar.bz2
mfd: Correct use after free for t7l66xb
The structure t7l66xb should not be freed before the subsequent references to its fields in the arguments to clk_put. Furthermore, this structure is allocated near the beginning of the function, and a goto to the label err_noirq appears after a successful allocation, so it would seem that the kfree should be moved down below this label. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression x,e; identifier f; iterator I; statement S; @@ *kfree(x); ... when != &x when != x = e when != I(x,...) S *x->f // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk>
Diffstat (limited to 'drivers/mfd')
-rw-r--r--drivers/mfd/t7l66xb.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c
index e0bbddd7aac2..26d9176fca91 100644
--- a/drivers/mfd/t7l66xb.c
+++ b/drivers/mfd/t7l66xb.c
@@ -403,12 +403,12 @@ static int t7l66xb_probe(struct platform_device *dev)
err_ioremap:
release_resource(&t7l66xb->rscr);
err_request_scr:
- kfree(t7l66xb);
clk_put(t7l66xb->clk48m);
err_clk48m_get:
clk_put(t7l66xb->clk32k);
err_clk32k_get:
err_noirq:
+ kfree(t7l66xb);
return ret;
}