diff options
| author | Julia Lawall <julia@diku.dk> | 2011-12-26 18:38:01 +0100 |
|---|---|---|
| committer | David Woodhouse <David.Woodhouse@intel.com> | 2012-01-09 18:24:05 +0000 |
| commit | af32b36095147e1828496b58987c1e24ef40487d (patch) | |
| tree | 377f57e77ef19d5b4dd206c343259cc8a5e6a207 | |
| parent | 775c32208708de3e2e2379c85e429ab11957f864 (diff) | |
mtd: lantiq-flash: drop iounmap for devm_ allocated data
Data allocated with devm_ioremap or devm_ioremap_nocache should not be
freed using iounmap, because doing so causes a dangling pointer, and a
subsequent double free.
The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)
// <smpl>
@r@
expression x;
@@
(
x = devm_ioremap(...)
|
x = devm_ioremap_nocache(...)
)
@@
expression r.x;
@@
* iounmap(x)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
| -rw-r--r-- | drivers/mtd/maps/lantiq-flash.c | 6 |
1 files changed, 1 insertions, 5 deletions
diff --git a/drivers/mtd/maps/lantiq-flash.c b/drivers/mtd/maps/lantiq-flash.c index 4f10e27ada55..7b889de9477b 100644 --- a/drivers/mtd/maps/lantiq-flash.c +++ b/drivers/mtd/maps/lantiq-flash.c @@ -159,7 +159,7 @@ ltq_mtd_probe(struct platform_device *pdev) if (!ltq_mtd->mtd) { dev_err(&pdev->dev, "probing failed\n"); err = -ENXIO; - goto err_unmap; + goto err_free; } ltq_mtd->mtd->owner = THIS_MODULE; @@ -179,8 +179,6 @@ ltq_mtd_probe(struct platform_device *pdev) err_destroy: map_destroy(ltq_mtd->mtd); -err_unmap: - iounmap(ltq_mtd->map->virt); err_free: kfree(ltq_mtd->map); err_out: @@ -198,8 +196,6 @@ ltq_mtd_remove(struct platform_device *pdev) mtd_device_unregister(ltq_mtd->mtd); map_destroy(ltq_mtd->mtd); } - if (ltq_mtd->map->virt) - iounmap(ltq_mtd->map->virt); kfree(ltq_mtd->map); kfree(ltq_mtd); } |