* [PATCH 2/5] drivers/net/wireless/ti/wlcore/main.c: eliminate possible double power off
[not found] <1350816727-1381-1-git-send-email-Julia.Lawall@lip6.fr>
@ 2012-10-21 10:52 ` Julia Lawall
2012-11-16 18:18 ` Luciano Coelho
2012-10-21 10:52 ` [PATCH 4/5] ath6kl/wmi.c: eliminate possible double free Julia Lawall
1 sibling, 1 reply; 4+ messages in thread
From: Julia Lawall @ 2012-10-21 10:52 UTC (permalink / raw)
To: Luciano Coelho
Cc: kernel-janitors, John W. Linville, linux-wireless, netdev,
linux-kernel
From: Julia Lawall <Julia.Lawall@lip6.fr>
The function wl12xx_set_power_on is only called twice, once in
wl12xx_chip_wakeup and once in wl12xx_get_hw_info. On the failure of the
call in wl12xx_chip_wakeup, the containing function just returns, but on
the failure of the call in wl12xx_get_hw_info, the containing function
calls wl1271_power_off. This does not seem necessary, because if
wl12xx_set_power_on has set the power on and then fails, it has already
turned the power off.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@
f(ps,T a,...) {
... when any
when != a = e
if(...) { ... free(a); ... return ...; }
... when any
}
@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@
* x = f(xs,a,...);
if (...) { ... free(a); ... return ...; }
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
---
wl1271_power_off seems to be resistent to being called when the power is
not on, so this should not change the behavior. Not tested.
drivers/net/wireless/ti/wlcore/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 25530c8..0eb739b 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -5116,7 +5116,7 @@ static int wl12xx_get_hw_info(struct wl1271 *wl)
ret = wl12xx_set_power_on(wl);
if (ret < 0)
- goto out;
+ return ret;
ret = wlcore_read_reg(wl, REG_CHIP_ID_B, &wl->chip.id);
if (ret < 0)
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH 4/5] ath6kl/wmi.c: eliminate possible double free
[not found] <1350816727-1381-1-git-send-email-Julia.Lawall@lip6.fr>
2012-10-21 10:52 ` [PATCH 2/5] drivers/net/wireless/ti/wlcore/main.c: eliminate possible double power off Julia Lawall
@ 2012-10-21 10:52 ` Julia Lawall
2012-11-16 11:17 ` Kalle Valo
1 sibling, 1 reply; 4+ messages in thread
From: Julia Lawall @ 2012-10-21 10:52 UTC (permalink / raw)
To: Kalle Valo
Cc: kernel-janitors, John W. Linville, linux-wireless, netdev,
linux-kernel
From: Julia Lawall <Julia.Lawall@lip6.fr>
This makes two changes. In ath6kl_wmi_cmd_send, a call to dev_kfree_skb on
the skb argument is added to the initial sanity check to more completely
establish the invariant that ath6kl_wmi_cmd_send owns its skb argument.
Then, in ath6kl_wmi_sync_point, on failure of the call to
ath6kl_wmi_cmd_send, the clearing of the local skb variable is moved up, so
that the error-handling code at the end of the function does not free it
again.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@
f(ps,T a,...) {
... when any
when != a = e
if(...) { ... free(a); ... return ...; }
... when any
}
@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@
* x = f(xs,a,...);
if (...) { ... free(a); ... return ...; }
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
---
Not tested.
drivers/net/wireless/ath/ath6kl/wmi.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index c30ab4b..50f50e4 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -1677,8 +1677,10 @@ int ath6kl_wmi_cmd_send(struct wmi *wmi, u8 if_idx, struct sk_buff *skb,
int ret;
u16 info1;
- if (WARN_ON(skb == NULL || (if_idx > (wmi->parent_dev->vif_max - 1))))
+ if (WARN_ON(skb == NULL || if_idx > (wmi->parent_dev->vif_max - 1))) {
+ dev_kfree_skb(skb);
return -EINVAL;
+ }
ath6kl_dbg(ATH6KL_DBG_WMI, "wmi tx id %d len %d flag %d\n",
cmd_id, skb->len, sync_flag);
@@ -2348,12 +2350,12 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx)
ret = ath6kl_wmi_cmd_send(wmi, if_idx, skb, WMI_SYNCHRONIZE_CMDID,
NO_SYNC_WMIFLAG);
- if (ret)
- goto free_skb;
-
/* cmd buffer sent, we no longer own it */
skb = NULL;
+ if (ret)
+ goto free_skb;
+
for (index = 0; index < num_pri_streams; index++) {
if (WARN_ON(!data_sync_bufs[index].skb))
^ permalink raw reply related [flat|nested] 4+ messages in thread