diff options
| author | Julia Lawall <julia@diku.dk> | 2010-04-02 14:47:38 +0200 |
|---|---|---|
| committer | David Woodhouse <David.Woodhouse@intel.com> | 2010-05-10 14:22:55 +0100 |
| commit | 258006d1abcf3f2990d3ebd77d75af335ff24d81 (patch) | |
| tree | 80d44a8767e365c33a247f63a9365cfcac05cbb6 /drivers/mtd/maps | |
| parent | c4e773764cead9358fd4b036d1b883fff3968513 (diff) | |
| download | linux-258006d1abcf3f2990d3ebd77d75af335ff24d81.tar.gz linux-258006d1abcf3f2990d3ebd77d75af335ff24d81.tar.bz2 linux-258006d1abcf3f2990d3ebd77d75af335ff24d81.zip | |
mtd: maps: Eliminate use after free
Moved the debugging message before the call to map_destroy, which frees its
argument. The message is also slightly changed to reflect its new
position.
A simplified version of the semantic patch that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
expression E,E2;
@@
del_mtd_device(E)
...
(
E = E2
|
* E
)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'drivers/mtd/maps')
| -rw-r--r-- | drivers/mtd/maps/pcmciamtd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mtd/maps/pcmciamtd.c b/drivers/mtd/maps/pcmciamtd.c index 689d6a79ffc0..81159d708f86 100644 --- a/drivers/mtd/maps/pcmciamtd.c +++ b/drivers/mtd/maps/pcmciamtd.c @@ -692,8 +692,8 @@ static void pcmciamtd_detach(struct pcmcia_device *link) if(dev->mtd_info) { del_mtd_device(dev->mtd_info); + info("mtd%d: Removing", dev->mtd_info->index); map_destroy(dev->mtd_info); - info("mtd%d: Removed", dev->mtd_info->index); } pcmciamtd_release(link); |