[PATCH 7/8] drivers/dma: introduce missing kfree

[PATCH 7/8] drivers/dma: introduce missing kfree

[Julia Lawall]

From: Julia Lawall <julia@diku.dk>

Error handling code following a kzalloc should free the allocated data.

The semantic match that finds this problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)

// <smpl>
@r exists@
local idexpression x;
statement S;
expression E;
identifier f,f1,l;
position p1,p2;
expression *ptr != NULL;
@@

x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
...
if (x == NULL) S
<... when != x
     when != if (...) { <+...x...+> }
(
x->f1 = E
|
 (x->f1 == NULL || ...)
|
 f(...,x->f1,...)
)
...>
(
 return \(0\|<+...x...+>\|ptr\);
|
 return@p2 ...;
)

@script:python@
p1 << r.p1;
p2 << r.p2;
@@

print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line)
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
---
 drivers/dma/shdma.c                 |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index b3b065c..0cd0d58 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -649,7 +649,7 @@ static int __init sh_dmae_probe(struct platform_device *pdev)
 
 	/* get platform data */
 	if (!pdev->dev.platform_data)
-		goto shdev_err;
+		goto platform_err;
 
 	/* platform data */
 	memcpy(&shdev->pdata, pdev->dev.platform_data,
@@ -720,6 +720,7 @@ eirq_err:
 		free_irq(eirq[ecnt], shdev);
 
 rst_err:
+platform_err:
 	kfree(shdev);
 
 shdev_err:

Re: [PATCH 7/8] drivers/dma: introduce missing kfree

[Dan Williams]

On Sat, Nov 21, 2009 at 4:52 AM, Julia Lawall <julia@diku.dk> wrote:
> From: Julia Lawall <julia@diku.dk>
>
> Error handling code following a kzalloc should free the allocated data.
>

Yes, but there is another buglet here:

>        /* get platform data */
>        if (!pdev->dev.platform_data)
> -               goto shdev_err;
> +               goto platform_err;

"err" is still zero at this point so the probe does not fail.

How about the following instead?

diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index b3b065c..034ecf0 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -640,17 +640,16 @@ static int __init sh_dmae_probe(struct
platform_device *pdev)
 #endif
        struct sh_dmae_device *shdev;

+       /* get platform data */
+       if (!pdev->dev.platform_data)
+               return -ENODEV;
+
        shdev = kzalloc(sizeof(struct sh_dmae_device), GFP_KERNEL);
        if (!shdev) {
                dev_err(&pdev->dev, "No enough memory\n");
-               err = -ENOMEM;
-               goto shdev_err;
+               return -ENOMEM;
        }

-       /* get platform data */
-       if (!pdev->dev.platform_data)
-               goto shdev_err;
-
        /* platform data */
        memcpy(&shdev->pdata, pdev->dev.platform_data,
                        sizeof(struct sh_dmae_pdata));
@@ -722,7 +721,6 @@ eirq_err:
 rst_err:
        kfree(shdev);

-shdev_err:
        return err;
 }

Re: [PATCH 7/8] drivers/dma: introduce missing kfree

[Julia Lawall]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 1640 bytes --]

On Sat, 21 Nov 2009, Dan Williams wrote:

> On Sat, Nov 21, 2009 at 4:52 AM, Julia Lawall <julia@diku.dk> wrote:
> > From: Julia Lawall <julia@diku.dk>
> >
> > Error handling code following a kzalloc should free the allocated data.
> >
> 
> Yes, but there is another buglet here:
> 
> >        /* get platform data */
> >        if (!pdev->dev.platform_data)
> > -               goto shdev_err;
> > +               goto platform_err;
> 
> "err" is still zero at this point so the probe does not fail.
> 
> How about the following instead?

OK, that is indeed both better and simpler.

thanks,
julia


> diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
> index b3b065c..034ecf0 100644
> --- a/drivers/dma/shdma.c
> +++ b/drivers/dma/shdma.c
> @@ -640,17 +640,16 @@ static int __init sh_dmae_probe(struct
> platform_device *pdev)
>  #endif
>         struct sh_dmae_device *shdev;
> 
> +       /* get platform data */
> +       if (!pdev->dev.platform_data)
> +               return -ENODEV;
> +
>         shdev = kzalloc(sizeof(struct sh_dmae_device), GFP_KERNEL);
>         if (!shdev) {
>                 dev_err(&pdev->dev, "No enough memory\n");
> -               err = -ENOMEM;
> -               goto shdev_err;
> +               return -ENOMEM;
>         }
> 
> -       /* get platform data */
> -       if (!pdev->dev.platform_data)
> -               goto shdev_err;
> -
>         /* platform data */
>         memcpy(&shdev->pdata, pdev->dev.platform_data,
>                         sizeof(struct sh_dmae_pdata));
> @@ -722,7 +721,6 @@ eirq_err:
>  rst_err:
>         kfree(shdev);
> 
> -shdev_err:
>         return err;
>  }
>