mtd: lantiq-flash: drop iounmap for devm_ allocated data

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=af32b36095147e1828496b58987c1e24ef40487d
Commit:     af32b36095147e1828496b58987c1e24ef40487d
Parent:     775c32208708de3e2e2379c85e429ab11957f864
Author:     Julia Lawall <julia at diku.dk>
AuthorDate: Mon Dec 26 18:38:01 2011 +0100
Committer:  David Woodhouse <David.Woodhouse at intel.com>
CommitDate: Mon Jan 9 18:24:05 2012 +0000

    mtd: lantiq-flash: drop iounmap for devm_ allocated data
    
    Data allocated with devm_ioremap or devm_ioremap_nocache should not be
    freed using iounmap, because doing so causes a dangling pointer, and a
    subsequent double free.
    
    The semantic match that finds this problem is as follows:
    (http://coccinelle.lip6.fr/)
    
    // <smpl>
    @r@
    expression x;
    @@
    (
     x = devm_ioremap(...)
    |
     x = devm_ioremap_nocache(...)
    )
    
    @@
    expression r.x;
    @@
    * iounmap(x)
    // </smpl>
    
    Signed-off-by: Julia Lawall <julia at diku.dk>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy at intel.com>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
---
 drivers/mtd/maps/lantiq-flash.c |    6 +-----
 1 files changed, 1 insertions(+), 5 deletions(-)

diff --git a/drivers/mtd/maps/lantiq-flash.c b/drivers/mtd/maps/lantiq-flash.c
index 4f10e27..7b889de 100644
--- a/drivers/mtd/maps/lantiq-flash.c
+++ b/drivers/mtd/maps/lantiq-flash.c
@@ -159,7 +159,7 @@ ltq_mtd_probe(struct platform_device *pdev)
 	if (!ltq_mtd->mtd) {
 		dev_err(&pdev->dev, "probing failed\n");
 		err = -ENXIO;
-		goto err_unmap;
+		goto err_free;
 	}
 
 	ltq_mtd->mtd->owner = THIS_MODULE;
@@ -179,8 +179,6 @@ ltq_mtd_probe(struct platform_device *pdev)
 
 err_destroy:
 	map_destroy(ltq_mtd->mtd);
-err_unmap:
-	iounmap(ltq_mtd->map->virt);
 err_free:
 	kfree(ltq_mtd->map);
 err_out:
@@ -198,8 +196,6 @@ ltq_mtd_remove(struct platform_device *pdev)
 			mtd_device_unregister(ltq_mtd->mtd);
 			map_destroy(ltq_mtd->mtd);
 		}
-		if (ltq_mtd->map->virt)
-			iounmap(ltq_mtd->map->virt);
 		kfree(ltq_mtd->map);
 		kfree(ltq_mtd);
 	}