Skip to content
  1. Oct 24, 2012
  3. Oct 22, 2012
  5. Oct 21, 2012
    • Julia Lawall's avatar
      ALSA: sound/isa/opti9xx/miro.c: eliminate possible double free · edb66893
      Julia Lawall authored 
      snd_miro_probe is a static function that is only called twice in the file
that defines it.  At each call site, its argument is freed using
snd_card_free.  Thus, there is no need for snd_miro_probe to call
snd_card_free on its argument on any of its error exit paths.

Because snd_card_free both reads the fields of its argument and kfrees its
argments, the results of the second snd_card_free should be unpredictable.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/

)

// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@

f(ps,T a,...) {
  ... when any
      when != a = e
  if(...) { ... free(a); ... return ...; }
  ... when any
}

@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@

* x = f(xs,a,...);
  if (...) { ... free(a); ... return ...; }
// </smpl>

Signed-off-by: default avatarJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      edb66893
  7. Oct 20, 2012
  9. Oct 19, 2012
  11. Oct 17, 2012
  13. Oct 16, 2012
  15. Oct 15, 2012
  17. Oct 11, 2012
  19. Oct 10, 2012
  21. Oct 09, 2012
  23. Oct 08, 2012