mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
mtd: lantiq-flash: drop iounmap for devm_ allocated data
Data allocated with devm_ioremap or devm_ioremap_nocache should not be freed using iounmap, because doing so causes a dangling pointer, and a subsequent double free. The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @r@ expression x; @@ ( x = devm_ioremap(...) | x = devm_ioremap_nocache(...) ) @@ expression r.x; @@ * iounmap(x) // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@intel.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
This commit is contained in:
parent
775c322087
commit
af32b36095
1 changed files with 1 additions and 5 deletions
|
@ -159,7 +159,7 @@ ltq_mtd_probe(struct platform_device *pdev)
|
|||
if (!ltq_mtd->mtd) {
|
||||
dev_err(&pdev->dev, "probing failed\n");
|
||||
err = -ENXIO;
|
||||
goto err_unmap;
|
||||
goto err_free;
|
||||
}
|
||||
|
||||
ltq_mtd->mtd->owner = THIS_MODULE;
|
||||
|
@ -179,8 +179,6 @@ ltq_mtd_probe(struct platform_device *pdev)
|
|||
|
||||
err_destroy:
|
||||
map_destroy(ltq_mtd->mtd);
|
||||
err_unmap:
|
||||
iounmap(ltq_mtd->map->virt);
|
||||
err_free:
|
||||
kfree(ltq_mtd->map);
|
||||
err_out:
|
||||
|
@ -198,8 +196,6 @@ ltq_mtd_remove(struct platform_device *pdev)
|
|||
mtd_device_unregister(ltq_mtd->mtd);
|
||||
map_destroy(ltq_mtd->mtd);
|
||||
}
|
||||
if (ltq_mtd->map->virt)
|
||||
iounmap(ltq_mtd->map->virt);
|
||||
kfree(ltq_mtd->map);
|
||||
kfree(ltq_mtd);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue