1. Jan 20, 2013
    • Julia Lawall's avatar
      crypto: bfin_crc - reposition free_irq to avoid access to invalid data · 17bebdcd
      Julia Lawall authored
      The data referenced by an interrupt handler should not be freed before the
      interrupt is ended.  The handler is bfin_crypto_crc_handler.  It may refer
      to crc->regs, which is released by the iounmap.
      
      Furthermore, the second argument to all calls to free_irq is incorrect.  It
      should be the same as the last argument of request_irq, which is crc,
      rather than crc->dev.
      
      The semantic match that finds the first problem is as follows:
      (http://coccinelle.lip6.fr/
      
      )
      
      // <smpl>
      @fn exists@
      expression list es;
      expression a,b;
      identifier f;
      @@
      
      if (...) {
        ... when any
        free_irq(a,b);
        ... when any
        f(es);
        ... when any
        return ...;
      }
      
      @@
      expression list fn.es;
      expression fn.a,fn.b;
      identifier fn.f;
      @@
      
      *f(es);
      ... when any
      *free_irq(a,b);
      // </smpl>
      
      Signed-off-by: default avatarJulia Lawall <Julia.Lawall@lip6.fr>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      17bebdcd
  2. Jan 05, 2013
  3. Dec 22, 2012