aboutsummaryrefslogtreecommitdiff
path: root/drivers/mtd/maps/lantiq-flash.c
diff options
context:
space:
mode:
authorJulia Lawall <julia@diku.dk>2011-12-26 18:38:01 +0100
committerDavid Woodhouse <David.Woodhouse@intel.com>2012-01-09 18:24:05 +0000
commitaf32b36095147e1828496b58987c1e24ef40487d (patch)
tree377f57e77ef19d5b4dd206c343259cc8a5e6a207 /drivers/mtd/maps/lantiq-flash.c
parent775c32208708de3e2e2379c85e429ab11957f864 (diff)
mtd: lantiq-flash: drop iounmap for devm_ allocated data
Data allocated with devm_ioremap or devm_ioremap_nocache should not be freed using iounmap, because doing so causes a dangling pointer, and a subsequent double free. The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @r@ expression x; @@ ( x = devm_ioremap(...) | x = devm_ioremap_nocache(...) ) @@ expression r.x; @@ * iounmap(x) // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@intel.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'drivers/mtd/maps/lantiq-flash.c')
-rw-r--r--drivers/mtd/maps/lantiq-flash.c6
1 files changed, 1 insertions, 5 deletions
diff --git a/drivers/mtd/maps/lantiq-flash.c b/drivers/mtd/maps/lantiq-flash.c
index 4f10e27ada5..7b889de9477 100644
--- a/drivers/mtd/maps/lantiq-flash.c
+++ b/drivers/mtd/maps/lantiq-flash.c
@@ -159,7 +159,7 @@ ltq_mtd_probe(struct platform_device *pdev)
if (!ltq_mtd->mtd) {
dev_err(&pdev->dev, "probing failed\n");
err = -ENXIO;
- goto err_unmap;
+ goto err_free;
}
ltq_mtd->mtd->owner = THIS_MODULE;
@@ -179,8 +179,6 @@ ltq_mtd_probe(struct platform_device *pdev)
err_destroy:
map_destroy(ltq_mtd->mtd);
-err_unmap:
- iounmap(ltq_mtd->map->virt);
err_free:
kfree(ltq_mtd->map);
err_out:
@@ -198,8 +196,6 @@ ltq_mtd_remove(struct platform_device *pdev)
mtd_device_unregister(ltq_mtd->mtd);
map_destroy(ltq_mtd->mtd);
}
- if (ltq_mtd->map->virt)
- iounmap(ltq_mtd->map->virt);
kfree(ltq_mtd->map);
kfree(ltq_mtd);
}