Messages in this thread Patch in this message | | | Date | Fri, 2 Apr 2010 14:47:38 +0200 (CEST) | From | Julia Lawall <> | Subject | [PATCH 2/3] drivers/mtd/maps: Eliminate use after free |
| |
From: Julia Lawall <julia@diku.dk>
Moved the debugging message before the call to map_destroy, which frees its argument. The message is also slightly changed to reflect its new position.
A simplified version of the semantic patch that finds this problem is as follows: (http://coccinelle.lip6.fr/)
// <smpl> @@ expression E,E2; @@
del_mtd_device(E) ... ( E = E2 | * E ) // </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
--- drivers/mtd/maps/pcmciamtd.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/mtd/maps/pcmciamtd.c b/drivers/mtd/maps/pcmciamtd.c index 87b2b8f..3e339de 100644 --- a/drivers/mtd/maps/pcmciamtd.c +++ b/drivers/mtd/maps/pcmciamtd.c @@ -689,8 +689,8 @@ static void pcmciamtd_detach(struct pcmcia_device *link) if(dev->mtd_info) { del_mtd_device(dev->mtd_info); + info("mtd%d: Removing", dev->mtd_info->index); map_destroy(dev->mtd_info); - info("mtd%d: Removed", dev->mtd_info->index); } pcmciamtd_release(link);
| |