Commit a081da63 authored Aug 08, 2011 by Julia Lawall Committed by Jeff Garzik Aug 18, 2011

drivers/ata/sata_dwc_460ex.c: add missing kfree

Currently, error handling code in this function calls the function
sata_dwc_port_stop, but this function has essentially no effect if hsdevp
has not been stored in ap, which is the case throughout this function.  The
only effect is to print a debugging message including ap->print_id.

The code is rewritten to not call sata_dwc_port_stop, but instead to jump
to a local label that prints the original error message and the print_id
information.  In the case where hsdevp has been already allocated (but not
yet stored in ap), this value is freed as well.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/

)

// <smpl>
@exists@
local idexpression x;
statement S,S1;
expression E;
identifier fl;
expression *ptr != NULL;
@@

x = \(kmalloc\|kzalloc\|kcalloc\)(...);
...
if (x == NULL) S
<... when != x
     when != if (...) { <+...kfree(x)...+> }
     when any
     when != true x == NULL
x->fl
...>
(
if (x == NULL) S1
|
if (...) { ... when != x
               when forall
(
 return \(0\|<+...x...+>\|ptr\);
|
* return ...;
)
}
)
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

parent e39c75cf

drivers/ata/sata_dwc_460ex.c

+6 −8

Original line number	Diff line number	Diff line
		@@ -1329,7 +1329,7 @@ static int sata_dwc_port_start(struct ata_port *ap)
		dev_err(ap->dev, "%s: dma_alloc_coherent failed\n",
		__func__);
		err = -ENOMEM;
		goto CLEANUP;
		goto CLEANUP_ALLOC;
		}
		}

		@@ -1349,15 +1349,13 @@ static int sata_dwc_port_start(struct ata_port *ap)
		/* Clear any error bits before libata starts issuing commands */
		clear_serror();
		ap->private_data = hsdevp;

		CLEANUP:
		if (err) {
		sata_dwc_port_stop(ap);
		dev_dbg(ap->dev, "%s: fail\n", __func__);
		} else {
		dev_dbg(ap->dev, "%s: done\n", __func__);
		}
		return 0;

		CLEANUP_ALLOC:
		kfree(hsdevp);
		CLEANUP:
		dev_dbg(ap->dev, "%s: fail. ap->id = %d\n", __func__, ap->print_id);
		return err;
		}