From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757301Ab1EMNwU (ORCPT ); Fri, 13 May 2011 09:52:20 -0400 Received: from mgw2.diku.dk ([130.225.96.92]:38800 "EHLO mgw2.diku.dk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756069Ab1EMNwQ (ORCPT ); Fri, 13 May 2011 09:52:16 -0400 From: Julia Lawall To: Thomas Gleixner Cc: kernel-janitors@vger.kernel.org, Ingo Molnar , "H. Peter Anvin" , x86@kernel.org, Borislav Petkov , Robert Richter , Yinghai Lu , Andreas Herrmann , linux-kernel@vger.kernel.org Subject: [PATCH 1/3] arch/x86/kernel/cpu/mcheck/mce_amd.c: Avoid leaving freed data in a list Date: Fri, 13 May 2011 15:52:09 +0200 Message-Id: <1305294731-12127-1-git-send-email-julia@diku.dk> X-Mailer: git-send-email 1.7.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org b may be added to a list, but is not removed before being freed in the case of an error. This is done in the corresponding deallocation function, so the code here has been changed to follow that. The sematic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @@ expression E,E1,E2; identifier l; @@ *list_add(&E->l,E1); ... when != E1 when != list_del(&E->l) when != list_del_init(&E->l) when != E = E2 *kfree(E);// Signed-off-by: Julia Lawall --- arch/x86/kernel/cpu/mcheck/mce_amd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c index 167f97b..bb0adad 100644 --- a/arch/x86/kernel/cpu/mcheck/mce_amd.c +++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c @@ -509,6 +509,7 @@ recurse: out_free: if (b) { kobject_put(&b->kobj); + list_del(&b->miscj); kfree(b); } return err;