linux/sound/isa/opti9xx
Julia Lawall edb6689386 ALSA: sound/isa/opti9xx/miro.c: eliminate possible double free
snd_miro_probe is a static function that is only called twice in the file
that defines it.  At each call site, its argument is freed using
snd_card_free.  Thus, there is no need for snd_miro_probe to call
snd_card_free on its argument on any of its error exit paths.

Because snd_card_free both reads the fields of its argument and kfrees its
argments, the results of the second snd_card_free should be unpredictable.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@

f(ps,T a,...) {
  ... when any
      when != a = e
  if(...) { ... free(a); ... return ...; }
  ... when any
}

@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@

* x = f(xs,a,...);
  if (...) { ... free(a); ... return ...; }
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-10-21 14:17:43 +02:00
..
Makefile [ALSA] Changed Jaroslav Kysela's e-mail from perex@suse.cz to perex@perex.cz 2007-10-16 16:51:18 +02:00
miro.c ALSA: sound/isa/opti9xx/miro.c: eliminate possible double free 2012-10-21 14:17:43 +02:00
opti92x-ad1848.c ALSA: isa: Move snd_legacy_find_free_ioport to initval.h 2012-08-03 12:57:44 +02:00
opti92x-cs4231.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
opti93x.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00