[PATCH 3/5] arch/powerpc/kernel/rtas_flash.c: eliminate possible double free

From: Julia Lawall
Date: Sun Oct 21 2012 - 06:52:38 EST

From: Julia Lawall <Julia.Lawall@xxxxxxx>

The function initialize_flash_pde_data is only called four times. All four
calls are in the function rtas_flash_init, and on the failure of any of the
calls, remove_flash_pde is called on the third argument of each of the
calls. There is thus no need for initialize_flash_pde_data to call
remove_flash_pde on the same argument. remove_flash_pde kfrees the data
field of its argument, and does not clear that field, so this amounts ot a
possible double free.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;

f(ps,T a,...) {
... when any
when != a = e
if(...) { ... free(a); ... return ...; }
... when any

identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;

* x = f(xs,a,...);
if (...) { ... free(a); ... return ...; }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@xxxxxxx>

Not tested.

arch/powerpc/kernel/rtas_flash.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 20b0120..8329190 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -650,10 +650,8 @@ static int initialize_flash_pde_data(const char *rtas_call_name,
int token;

dp->data = kzalloc(buf_size, GFP_KERNEL);
- if (dp->data == NULL) {
- remove_flash_pde(dp);
+ if (dp->data == NULL)
return -ENOMEM;
- }

* This code assumes that the status int is the first member of the

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/