* [PATCH 0/5] eliminate possible double free
@ 2012-10-21 10:52 Julia Lawall
2012-10-21 10:52 ` [PATCH 1/5] sound/isa/opti9xx/miro.c: " Julia Lawall
` (4 more replies)
0 siblings, 5 replies; 10+ messages in thread
From: Julia Lawall @ 2012-10-21 10:52 UTC (permalink / raw)
To: linux-kernel; +Cc: kernel-janitors
These patches fix cases where a called function frees some data and the
calling context frees the same data.
The complete semantic match is as follows: (http://coccinelle.lip6.fr/)
// <smpl>
@r exists@
parameter list[n] ps;
type T;
identifier a;
expression e;
expression ret != 0;
identifier f,free;
position p1;
@@
f(ps,T a,...) {
... when any
when != a = e
if(...) { ... free@p1(a); ... return ret; }
... when any
}
@s exists@
identifier r.f,r.free;
expression x,a;
position p2,p3;
expression list[r.n] xs;
@@
x = f@p2(xs,a,...);
if (...) { ... free@p3(a); ... return ...; }
@script:python@
p1 << r.p1;
p2 << s.p2;
p3 << s.p3;
@@
cocci.print_main("",p1)
cocci.print_secs("",p2)
cocci.print_secs("",p3)
// </smpl>
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH 1/5] sound/isa/opti9xx/miro.c: eliminate possible double free
2012-10-21 10:52 [PATCH 0/5] eliminate possible double free Julia Lawall
@ 2012-10-21 10:52 ` Julia Lawall
2012-10-21 12:18 ` Takashi Iwai
2012-10-21 10:52 ` [PATCH 2/5] drivers/net/wireless/ti/wlcore/main.c: eliminate possible double power off Julia Lawall
` (3 subsequent siblings)
4 siblings, 1 reply; 10+ messages in thread
From: Julia Lawall @ 2012-10-21 10:52 UTC (permalink / raw)
To: Jaroslav Kysela; +Cc: kernel-janitors, Takashi Iwai, alsa-devel, linux-kernel
From: Julia Lawall <Julia.Lawall@lip6.fr>
snd_miro_probe is a static function that is only called twice in the file
that defines it. At each call site, its argument is freed using
snd_card_free. Thus, there is no need for snd_miro_probe to call
snd_card_free on its argument on any of its error exit paths.
Because snd_card_free both reads the fields of its argument and kfrees its
argments, the results of the second snd_card_free should be unpredictable.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@
f(ps,T a,...) {
... when any
when != a = e
if(...) { ... free(a); ... return ...; }
... when any
}
@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@
* x = f(xs,a,...);
if (...) { ... free(a); ... return ...; }
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
---
Not tested.
sound/isa/opti9xx/miro.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/sound/isa/opti9xx/miro.c b/sound/isa/opti9xx/miro.c
index 3d1afb6..4a7ff4e 100644
--- a/sound/isa/opti9xx/miro.c
+++ b/sound/isa/opti9xx/miro.c
@@ -1286,7 +1286,6 @@ static int __devinit snd_miro_probe(struct snd_card *card)
error = snd_card_miro_aci_detect(card, miro);
if (error < 0) {
- snd_card_free(card);
snd_printk(KERN_ERR "unable to detect aci chip\n");
return -ENODEV;
}
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH 2/5] drivers/net/wireless/ti/wlcore/main.c: eliminate possible double power off
2012-10-21 10:52 [PATCH 0/5] eliminate possible double free Julia Lawall
2012-10-21 10:52 ` [PATCH 1/5] sound/isa/opti9xx/miro.c: " Julia Lawall
@ 2012-10-21 10:52 ` Julia Lawall
2012-11-16 18:18 ` Luciano Coelho
2012-10-21 10:52 ` [PATCH 3/5] arch/powerpc/kernel/rtas_flash.c: eliminate possible double free Julia Lawall
` (2 subsequent siblings)
4 siblings, 1 reply; 10+ messages in thread
From: Julia Lawall @ 2012-10-21 10:52 UTC (permalink / raw)
To: Luciano Coelho
Cc: kernel-janitors, John W. Linville, linux-wireless, netdev, linux-kernel
From: Julia Lawall <Julia.Lawall@lip6.fr>
The function wl12xx_set_power_on is only called twice, once in
wl12xx_chip_wakeup and once in wl12xx_get_hw_info. On the failure of the
call in wl12xx_chip_wakeup, the containing function just returns, but on
the failure of the call in wl12xx_get_hw_info, the containing function
calls wl1271_power_off. This does not seem necessary, because if
wl12xx_set_power_on has set the power on and then fails, it has already
turned the power off.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@
f(ps,T a,...) {
... when any
when != a = e
if(...) { ... free(a); ... return ...; }
... when any
}
@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@
* x = f(xs,a,...);
if (...) { ... free(a); ... return ...; }
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
---
wl1271_power_off seems to be resistent to being called when the power is
not on, so this should not change the behavior. Not tested.
drivers/net/wireless/ti/wlcore/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 25530c8..0eb739b 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -5116,7 +5116,7 @@ static int wl12xx_get_hw_info(struct wl1271 *wl)
ret = wl12xx_set_power_on(wl);
if (ret < 0)
- goto out;
+ return ret;
ret = wlcore_read_reg(wl, REG_CHIP_ID_B, &wl->chip.id);
if (ret < 0)
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH 3/5] arch/powerpc/kernel/rtas_flash.c: eliminate possible double free
2012-10-21 10:52 [PATCH 0/5] eliminate possible double free Julia Lawall
2012-10-21 10:52 ` [PATCH 1/5] sound/isa/opti9xx/miro.c: " Julia Lawall
2012-10-21 10:52 ` [PATCH 2/5] drivers/net/wireless/ti/wlcore/main.c: eliminate possible double power off Julia Lawall
@ 2012-10-21 10:52 ` Julia Lawall
2012-10-21 10:52 ` [PATCH 4/5] ath6kl/wmi.c: " Julia Lawall
2012-10-21 10:52 ` [PATCH 5/5] drivers/iio/industrialio-event.c: " Julia Lawall
4 siblings, 0 replies; 10+ messages in thread
From: Julia Lawall @ 2012-10-21 10:52 UTC (permalink / raw)
To: Benjamin Herrenschmidt
Cc: kernel-janitors, Paul Mackerras, linuxppc-dev, linux-kernel
From: Julia Lawall <Julia.Lawall@lip6.fr>
The function initialize_flash_pde_data is only called four times. All four
calls are in the function rtas_flash_init, and on the failure of any of the
calls, remove_flash_pde is called on the third argument of each of the
calls. There is thus no need for initialize_flash_pde_data to call
remove_flash_pde on the same argument. remove_flash_pde kfrees the data
field of its argument, and does not clear that field, so this amounts ot a
possible double free.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@
f(ps,T a,...) {
... when any
when != a = e
if(...) { ... free(a); ... return ...; }
... when any
}
@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@
* x = f(xs,a,...);
if (...) { ... free(a); ... return ...; }
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
---
Not tested.
arch/powerpc/kernel/rtas_flash.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 20b0120..8329190 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -650,10 +650,8 @@ static int initialize_flash_pde_data(const char *rtas_call_name,
int token;
dp->data = kzalloc(buf_size, GFP_KERNEL);
- if (dp->data == NULL) {
- remove_flash_pde(dp);
+ if (dp->data == NULL)
return -ENOMEM;
- }
/*
* This code assumes that the status int is the first member of the
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH 4/5] ath6kl/wmi.c: eliminate possible double free
2012-10-21 10:52 [PATCH 0/5] eliminate possible double free Julia Lawall
` (2 preceding siblings ...)
2012-10-21 10:52 ` [PATCH 3/5] arch/powerpc/kernel/rtas_flash.c: eliminate possible double free Julia Lawall
@ 2012-10-21 10:52 ` Julia Lawall
2012-11-16 11:17 ` Kalle Valo
2012-10-21 10:52 ` [PATCH 5/5] drivers/iio/industrialio-event.c: " Julia Lawall
4 siblings, 1 reply; 10+ messages in thread
From: Julia Lawall @ 2012-10-21 10:52 UTC (permalink / raw)
To: Kalle Valo
Cc: kernel-janitors, John W. Linville, linux-wireless, netdev, linux-kernel
From: Julia Lawall <Julia.Lawall@lip6.fr>
This makes two changes. In ath6kl_wmi_cmd_send, a call to dev_kfree_skb on
the skb argument is added to the initial sanity check to more completely
establish the invariant that ath6kl_wmi_cmd_send owns its skb argument.
Then, in ath6kl_wmi_sync_point, on failure of the call to
ath6kl_wmi_cmd_send, the clearing of the local skb variable is moved up, so
that the error-handling code at the end of the function does not free it
again.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@
f(ps,T a,...) {
... when any
when != a = e
if(...) { ... free(a); ... return ...; }
... when any
}
@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@
* x = f(xs,a,...);
if (...) { ... free(a); ... return ...; }
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
---
Not tested.
drivers/net/wireless/ath/ath6kl/wmi.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index c30ab4b..50f50e4 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -1677,8 +1677,10 @@ int ath6kl_wmi_cmd_send(struct wmi *wmi, u8 if_idx, struct sk_buff *skb,
int ret;
u16 info1;
- if (WARN_ON(skb == NULL || (if_idx > (wmi->parent_dev->vif_max - 1))))
+ if (WARN_ON(skb == NULL || if_idx > (wmi->parent_dev->vif_max - 1))) {
+ dev_kfree_skb(skb);
return -EINVAL;
+ }
ath6kl_dbg(ATH6KL_DBG_WMI, "wmi tx id %d len %d flag %d\n",
cmd_id, skb->len, sync_flag);
@@ -2348,12 +2350,12 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx)
ret = ath6kl_wmi_cmd_send(wmi, if_idx, skb, WMI_SYNCHRONIZE_CMDID,
NO_SYNC_WMIFLAG);
- if (ret)
- goto free_skb;
-
/* cmd buffer sent, we no longer own it */
skb = NULL;
+ if (ret)
+ goto free_skb;
+
for (index = 0; index < num_pri_streams; index++) {
if (WARN_ON(!data_sync_bufs[index].skb))
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH 5/5] drivers/iio/industrialio-event.c: eliminate possible double free
2012-10-21 10:52 [PATCH 0/5] eliminate possible double free Julia Lawall
` (3 preceding siblings ...)
2012-10-21 10:52 ` [PATCH 4/5] ath6kl/wmi.c: " Julia Lawall
@ 2012-10-21 10:52 ` Julia Lawall
2012-11-02 9:39 ` Jonathan Cameron
4 siblings, 1 reply; 10+ messages in thread
From: Julia Lawall @ 2012-10-21 10:52 UTC (permalink / raw)
To: Jonathan Cameron; +Cc: kernel-janitors, linux-iio, linux-kernel
From: Julia Lawall <Julia.Lawall@lip6.fr>
The function __iio_add_event_config_attrs is only called once, by the
function iio_device_register_eventset. If the call fails,
iio_device_register_eventset calls __iio_remove_event_config_attrs. There
is thus no need for __iio_add_event_config_attrs to also call
__iio_remove_event_config_attrs on failure.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@
f(ps,T a,...) {
... when any
when != a = e
if(...) { ... free(a); ... return ...; }
... when any
}
@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@
* x = f(xs,a,...);
if (...) { ... free(a); ... return ...; }
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
---
__iio_remove_event_config_attrs kfrees the elements of a list, but doesn't
actually remove them from the list. Perhaps for safety this should be
cleaned up as well. Not tested.
drivers/iio/industrialio-event.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c
index fa6543b..78570c7 100644
--- a/drivers/iio/industrialio-event.c
+++ b/drivers/iio/industrialio-event.c
@@ -350,15 +350,10 @@ static inline int __iio_add_event_config_attrs(struct iio_dev *indio_dev)
ret = iio_device_add_event_sysfs(indio_dev,
&indio_dev->channels[j]);
if (ret < 0)
- goto error_clear_attrs;
+ return ret;
attrcount += ret;
}
return attrcount;
-
-error_clear_attrs:
- __iio_remove_event_config_attrs(indio_dev);
-
- return ret;
}
static bool iio_check_for_dynamic_events(struct iio_dev *indio_dev)
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH 1/5] sound/isa/opti9xx/miro.c: eliminate possible double free
2012-10-21 10:52 ` [PATCH 1/5] sound/isa/opti9xx/miro.c: " Julia Lawall
@ 2012-10-21 12:18 ` Takashi Iwai
0 siblings, 0 replies; 10+ messages in thread
From: Takashi Iwai @ 2012-10-21 12:18 UTC (permalink / raw)
To: Julia Lawall; +Cc: Jaroslav Kysela, kernel-janitors, alsa-devel, linux-kernel
At Sun, 21 Oct 2012 12:52:03 +0200,
Julia Lawall wrote:
>
> From: Julia Lawall <Julia.Lawall@lip6.fr>
>
> snd_miro_probe is a static function that is only called twice in the file
> that defines it. At each call site, its argument is freed using
> snd_card_free. Thus, there is no need for snd_miro_probe to call
> snd_card_free on its argument on any of its error exit paths.
>
> Because snd_card_free both reads the fields of its argument and kfrees its
> argments, the results of the second snd_card_free should be unpredictable.
>
> A simplified version of the semantic match that finds this problem is as
> follows: (http://coccinelle.lip6.fr/)
>
> // <smpl>
> @r@
> identifier f,free,a;
> parameter list[n] ps;
> type T;
> expression e;
> @@
>
> f(ps,T a,...) {
> ... when any
> when != a = e
> if(...) { ... free(a); ... return ...; }
> ... when any
> }
>
> @@
> identifier r.f,r.free;
> expression x,a;
> expression list[r.n] xs;
> @@
>
> * x = f(xs,a,...);
> if (...) { ... free(a); ... return ...; }
> // </smpl>
>
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Thanks, applied.
Takashi
>
> ---
> Not tested.
>
> sound/isa/opti9xx/miro.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/sound/isa/opti9xx/miro.c b/sound/isa/opti9xx/miro.c
> index 3d1afb6..4a7ff4e 100644
> --- a/sound/isa/opti9xx/miro.c
> +++ b/sound/isa/opti9xx/miro.c
> @@ -1286,7 +1286,6 @@ static int __devinit snd_miro_probe(struct snd_card *card)
>
> error = snd_card_miro_aci_detect(card, miro);
> if (error < 0) {
> - snd_card_free(card);
> snd_printk(KERN_ERR "unable to detect aci chip\n");
> return -ENODEV;
> }
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 5/5] drivers/iio/industrialio-event.c: eliminate possible double free
2012-10-21 10:52 ` [PATCH 5/5] drivers/iio/industrialio-event.c: " Julia Lawall
@ 2012-11-02 9:39 ` Jonathan Cameron
0 siblings, 0 replies; 10+ messages in thread
From: Jonathan Cameron @ 2012-11-02 9:39 UTC (permalink / raw)
To: Julia Lawall; +Cc: Jonathan Cameron, kernel-janitors, linux-iio, linux-kernel
On 10/21/2012 11:52 AM, Julia Lawall wrote:
> From: Julia Lawall <Julia.Lawall@lip6.fr>
>
> The function __iio_add_event_config_attrs is only called once, by the
> function iio_device_register_eventset. If the call fails,
> iio_device_register_eventset calls __iio_remove_event_config_attrs. There
> is thus no need for __iio_add_event_config_attrs to also call
> __iio_remove_event_config_attrs on failure.
>
> A simplified version of the semantic match that finds this problem is as
> follows: (http://coccinelle.lip6.fr/)
>
> // <smpl>
> @r@
> identifier f,free,a;
> parameter list[n] ps;
> type T;
> expression e;
> @@
>
> f(ps,T a,...) {
> ... when any
> when != a = e
> if(...) { ... free(a); ... return ...; }
> ... when any
> }
>
> @@
> identifier r.f,r.free;
> expression x,a;
> expression list[r.n] xs;
> @@
>
> * x = f(xs,a,...);
> if (...) { ... free(a); ... return ...; }
> // </smpl>
>
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Thanks - merged to fixes-togreg branch of iio.git
Jonathan
>
> ---
> __iio_remove_event_config_attrs kfrees the elements of a list, but doesn't
> actually remove them from the list. Perhaps for safety this should be
> cleaned up as well. Not tested.
>
> drivers/iio/industrialio-event.c | 7 +------
> 1 file changed, 1 insertion(+), 6 deletions(-)
>
> diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c
> index fa6543b..78570c7 100644
> --- a/drivers/iio/industrialio-event.c
> +++ b/drivers/iio/industrialio-event.c
> @@ -350,15 +350,10 @@ static inline int __iio_add_event_config_attrs(struct iio_dev *indio_dev)
> ret = iio_device_add_event_sysfs(indio_dev,
> &indio_dev->channels[j]);
> if (ret < 0)
> - goto error_clear_attrs;
> + return ret;
> attrcount += ret;
> }
> return attrcount;
> -
> -error_clear_attrs:
> - __iio_remove_event_config_attrs(indio_dev);
> -
> - return ret;
> }
>
> static bool iio_check_for_dynamic_events(struct iio_dev *indio_dev)
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-iio" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 4/5] ath6kl/wmi.c: eliminate possible double free
2012-10-21 10:52 ` [PATCH 4/5] ath6kl/wmi.c: " Julia Lawall
@ 2012-11-16 11:17 ` Kalle Valo
0 siblings, 0 replies; 10+ messages in thread
From: Kalle Valo @ 2012-11-16 11:17 UTC (permalink / raw)
To: Julia Lawall
Cc: kernel-janitors, John W. Linville, linux-wireless, netdev, linux-kernel
Hi Julia,
On 10/21/2012 01:52 PM, Julia Lawall wrote:
> From: Julia Lawall <Julia.Lawall@lip6.fr>
>
> This makes two changes. In ath6kl_wmi_cmd_send, a call to dev_kfree_skb on
> the skb argument is added to the initial sanity check to more completely
> establish the invariant that ath6kl_wmi_cmd_send owns its skb argument.
> Then, in ath6kl_wmi_sync_point, on failure of the call to
> ath6kl_wmi_cmd_send, the clearing of the local skb variable is moved up, so
> that the error-handling code at the end of the function does not free it
> again.
>
> A simplified version of the semantic match that finds this problem is as
> follows: (http://coccinelle.lip6.fr/)
>
> // <smpl>
> @r@
> identifier f,free,a;
> parameter list[n] ps;
> type T;
> expression e;
> @@
>
> f(ps,T a,...) {
> ... when any
> when != a = e
> if(...) { ... free(a); ... return ...; }
> ... when any
> }
>
> @@
> identifier r.f,r.free;
> expression x,a;
> expression list[r.n] xs;
> @@
>
> * x = f(xs,a,...);
> if (...) { ... free(a); ... return ...; }
> // </smpl>
>
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
I think this patch which is commited to ath6kl.git has fixed this.
commit 0616dc1f2bef563d7916c0dcedbb1bff7d9bd80b
Author: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Date: Tue Aug 14 10:10:33 2012 +0530
ath6kl: Fix potential skb double free in ath6kl_wmi_sync_point()
skb given to ath6kl_control_tx() is owned by ath6kl_control_tx().
Calling function should not free the skb for error cases.
This is found during code review.
kvalo: fix a checkpatch warning in ath6kl_wmi_cmd_send()
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
https://github.com/kvalo/ath6kl/commit/0616dc1f2bef563d7916c0dcedbb1bff7d9bd80b
If you have the time, I would appreciate if you could take a look and
confirm.
Kalle
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 2/5] drivers/net/wireless/ti/wlcore/main.c: eliminate possible double power off
2012-10-21 10:52 ` [PATCH 2/5] drivers/net/wireless/ti/wlcore/main.c: eliminate possible double power off Julia Lawall
@ 2012-11-16 18:18 ` Luciano Coelho
0 siblings, 0 replies; 10+ messages in thread
From: Luciano Coelho @ 2012-11-16 18:18 UTC (permalink / raw)
To: Julia Lawall
Cc: kernel-janitors, John W. Linville, linux-wireless, netdev, linux-kernel
On Sun, 2012-10-21 at 12:52 +0200, Julia Lawall wrote:
> From: Julia Lawall <Julia.Lawall@lip6.fr>
>
> The function wl12xx_set_power_on is only called twice, once in
> wl12xx_chip_wakeup and once in wl12xx_get_hw_info. On the failure of the
> call in wl12xx_chip_wakeup, the containing function just returns, but on
> the failure of the call in wl12xx_get_hw_info, the containing function
> calls wl1271_power_off. This does not seem necessary, because if
> wl12xx_set_power_on has set the power on and then fails, it has already
> turned the power off.
[...]
Applied and pushed, thanks!
--
Luca.
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2012-11-16 18:19 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-10-21 10:52 [PATCH 0/5] eliminate possible double free Julia Lawall
2012-10-21 10:52 ` [PATCH 1/5] sound/isa/opti9xx/miro.c: " Julia Lawall
2012-10-21 12:18 ` Takashi Iwai
2012-10-21 10:52 ` [PATCH 2/5] drivers/net/wireless/ti/wlcore/main.c: eliminate possible double power off Julia Lawall
2012-11-16 18:18 ` Luciano Coelho
2012-10-21 10:52 ` [PATCH 3/5] arch/powerpc/kernel/rtas_flash.c: eliminate possible double free Julia Lawall
2012-10-21 10:52 ` [PATCH 4/5] ath6kl/wmi.c: " Julia Lawall
2012-11-16 11:17 ` Kalle Valo
2012-10-21 10:52 ` [PATCH 5/5] drivers/iio/industrialio-event.c: " Julia Lawall
2012-11-02 9:39 ` Jonathan Cameron
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).