• Julia Lawall's avatar
    mfd: Correct use after free for t7l66xb · 0e820ab6
    Julia Lawall authored
    The structure t7l66xb should not be freed before the subsequent references
    to its fields in the arguments to clk_put.  Furthermore, this structure is
    allocated near the beginning of the function, and a goto to the label
    err_noirq appears after a successful allocation, so it would seem that the
    kfree should be moved down below this label.
    
    A simplified version of the semantic match that finds this problem is as
    follows: (http://coccinelle.lip6.fr/)
    
    // <smpl>
    @@
    expression x,e;
    identifier f;
    iterator I;
    statement S;
    @@
    
    *kfree(x);
    ... when != &x
        when != x = e
        when != I(x,...) S
    *x->f
    // </smpl>
    Signed-off-by: default avatarJulia Lawall <julia@diku.dk>
    0e820ab6
t7l66xb.c 11.2 KB