Skip to content

Commit

Permalink
powerpc/pmac/windfarm: Correct potential double free
Browse files Browse the repository at this point in the history
The conditionals were testing different values, but then all freeing the
same one, which could result in a double free.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression x,e;
identifier f;
iterator I;
statement S;
@@

*kfree(x);
... when != &x
    when != x = e
    when != I(x,...) S
*x
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
  • Loading branch information
Julia Lawall authored and Benjamin Herrenschmidt committed Apr 7, 2010
1 parent 637a990 commit ab30f78
Showing 1 changed file with 3 additions and 6 deletions.
9 changes: 3 additions & 6 deletions drivers/macintosh/windfarm_pm91.c
Original file line number Diff line number Diff line change
Expand Up @@ -687,12 +687,9 @@ static int __devexit wf_smu_remove(struct platform_device *ddev)
wf_put_control(cpufreq_clamp);

/* Destroy control loops state structures */
if (wf_smu_slots_fans)
kfree(wf_smu_cpu_fans);
if (wf_smu_drive_fans)
kfree(wf_smu_cpu_fans);
if (wf_smu_cpu_fans)
kfree(wf_smu_cpu_fans);
kfree(wf_smu_slots_fans);
kfree(wf_smu_drive_fans);
kfree(wf_smu_cpu_fans);

return 0;
}
Expand Down

0 comments on commit ab30f78

Please sign in to comment.