lkml.org 
[lkml]   [2011]   [Jun]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] drivers/usb/gadget/inode.c: add missing kfree
Date
From: Julia Lawall <julia@diku.dk>

The label fail frees dev->buf, but kbuf hasn't yet been stored there at
this point.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@exists@
local idexpression x;
statement S;
expression E;
expression *ptr != NULL;
@@

x = memdup_user(...);
...
if (IS_ERR(x)) S
... when != x
when != x = E
(
return \(0\|<+...x...+>\|ptr\);
|
*return ...;
)
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>

---
I wonder if it is really correct to free dev->buf at fail in this case.
Because it is freeing the previously allocated value of dev->buf, not the
current one as done in subsequent cases.

drivers/usb/gadget/inode.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index a01383f..316547a 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -1870,8 +1870,10 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)

spin_lock_irq (&dev->lock);
value = -EINVAL;
- if (dev->buf)
+ if (dev->buf) {
+ kfree(kbuf);
goto fail;
+ }
dev->buf = kbuf;

/* full or low speed config */


\
 
 \ /
  Last update: 2011-06-02 10:29    [W:1.163 / U:0.368 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site