lkml.org 
[lkml]   [2010]   [Apr]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH 2/3] drivers/mtd/maps: Eliminate use after free
    From: Julia Lawall <julia@diku.dk>

    Moved the debugging message before the call to map_destroy, which frees its
    argument. The message is also slightly changed to reflect its new
    position.

    A simplified version of the semantic patch that finds this problem is as
    follows: (http://coccinelle.lip6.fr/)

    // <smpl>
    @@
    expression E,E2;
    @@

    del_mtd_device(E)
    ...
    (
    E = E2
    |
    * E
    )
    // </smpl>

    Signed-off-by: Julia Lawall <julia@diku.dk>

    ---
    drivers/mtd/maps/pcmciamtd.c | 2 +-
    1 files changed, 1 insertions(+), 1 deletions(-)

    diff --git a/drivers/mtd/maps/pcmciamtd.c b/drivers/mtd/maps/pcmciamtd.c
    index 87b2b8f..3e339de 100644
    --- a/drivers/mtd/maps/pcmciamtd.c
    +++ b/drivers/mtd/maps/pcmciamtd.c
    @@ -689,8 +689,8 @@ static void pcmciamtd_detach(struct pcmcia_device *link)

    if(dev->mtd_info) {
    del_mtd_device(dev->mtd_info);
    + info("mtd%d: Removing", dev->mtd_info->index);
    map_destroy(dev->mtd_info);
    - info("mtd%d: Removed", dev->mtd_info->index);
    }

    pcmciamtd_release(link);

    \
     
     \ /
      Last update: 2010-04-02 14:49    [W:0.025 / U:31.092 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site