lkml.org 
[lkml]   [2010]   [Mar]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[002/116] drivers/scsi/ses.c: eliminate double free
    2.6.32-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Julia Lawall <julia@diku.dk>

    commit 9b3a6549b2602ca30f58715a0071e29f9898cae9 upstream.

    The few lines below the kfree of hdr_buf may go to the label err_free
    which will also free hdr_buf. The most straightforward solution seems to
    be to just move the kfree of hdr_buf after these gotos.

    A simplified version of the semantic match that finds this problem is as
    follows: (http://coccinelle.lip6.fr/)

    // <smpl>
    @r@
    identifier E;
    expression E1;
    iterator I;
    statement S;
    @@

    *kfree(E);
    ... when != E = E1
    when != I(E,...) S
    when != &E
    *kfree(E);
    // </smpl>

    Signed-off-by: Julia Lawall <julia@diku.dk>
    Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/scsi/ses.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/drivers/scsi/ses.c
    +++ b/drivers/scsi/ses.c
    @@ -591,8 +591,6 @@ static int ses_intf_add(struct device *c
    ses_dev->page10_len = len;
    buf = NULL;
    }
    - kfree(hdr_buf);
    -
    scomp = kzalloc(sizeof(struct ses_component) * components, GFP_KERNEL);
    if (!scomp)
    goto err_free;
    @@ -604,6 +602,8 @@ static int ses_intf_add(struct device *c
    goto err_free;
    }

    + kfree(hdr_buf);
    +
    edev->scratch = ses_dev;
    for (i = 0; i < components; i++)
    edev->component[i].scratch = scomp + i;



    \
     
     \ /
      Last update: 2010-03-31 01:21    [W:3.001 / U:0.184 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site