summaryrefslogtreecommitdiffstats
path: root/drivers/mtd/maps
diff options
context:
space:
mode:
authorJulia Lawall <julia@diku.dk>2010-04-02 14:47:38 +0200
committerDavid Woodhouse <David.Woodhouse@intel.com>2010-05-10 14:22:55 +0100
commit258006d1abcf3f2990d3ebd77d75af335ff24d81 (patch)
tree80d44a8767e365c33a247f63a9365cfcac05cbb6 /drivers/mtd/maps
parentc4e773764cead9358fd4b036d1b883fff3968513 (diff)
mtd: maps: Eliminate use after free
Moved the debugging message before the call to map_destroy, which frees its argument. The message is also slightly changed to reflect its new position. A simplified version of the semantic patch that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression E,E2; @@ del_mtd_device(E) ... ( E = E2 | * E ) // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'drivers/mtd/maps')
-rw-r--r--drivers/mtd/maps/pcmciamtd.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mtd/maps/pcmciamtd.c b/drivers/mtd/maps/pcmciamtd.c
index 689d6a79ffc..81159d708f8 100644
--- a/drivers/mtd/maps/pcmciamtd.c
+++ b/drivers/mtd/maps/pcmciamtd.c
@@ -692,8 +692,8 @@ static void pcmciamtd_detach(struct pcmcia_device *link)
if(dev->mtd_info) {
del_mtd_device(dev->mtd_info);
+ info("mtd%d: Removing", dev->mtd_info->index);
map_destroy(dev->mtd_info);
- info("mtd%d: Removed", dev->mtd_info->index);
}
pcmciamtd_release(link);