Author: Julia Lawall <julia@diku.dk> Use kmemdup when some other buffer is immediately copied into the allocated region. A simplified version of the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // @@ expression from,to,size,flag; statement S; @@ – to = \(kmalloc\|kzalloc\)(size,flag); + to = kmemdup(from,size,flag); if (to==NULL || …) S – memcpy(to, from, …
May 16 2010
USB: gadget: Use kmemdup
Author: Julia Lawall <julia@diku.dk> Use kmemdup when some other buffer is immediately copied into the allocated region. A simplified version of the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // @@ expression from,to,size,flag; statement S; @@ – to = \(kmalloc\|kzalloc\)(size,flag); + to = kmemdup(from,size,flag); if (to==NULL || …) S – memcpy(to, from, …
May 16 2010
drivers/net/wireless/wl12xx: Use kmemdup
Author: Julia Lawall <julia@diku.dk> Use kmemdup when some other buffer is immediately copied into the allocated region. A simplified version of the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // @@ expression from,to,size,flag; statement S; @@ – to = \(kmalloc\|kzalloc\)(size,flag); + to = kmemdup(from,size,flag); if (to==NULL || …) S – memcpy(to, from, …
May 16 2010
drivers/net/wireless/libertas: Use kmemdup
Author: Julia Lawall <julia@diku.dk> Use kmemdup when some other buffer is immediately copied into the allocated region. A simplified version of the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // @@ expression from,to,size,flag; statement S; @@ – to = \(kmalloc\|kzalloc\)(size,flag); + to = kmemdup(from,size,flag); if (to==NULL || …) S – memcpy(to, from, …
May 15 2010
drivers/net/usb: Use kmemdup
Author: Julia Lawall <julia@diku.dk> Use kmemdup when some other buffer is immediately copied into the allocated region. A simplified version of the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // @@ expression from,to,size,flag; statement S; @@ – to = \(kmalloc\|kzalloc\)(size,flag); + to = kmemdup(from,size,flag); if (to==NULL || …) S – memcpy(to, from, …
May 15 2010
drivers/net/usb: Use kmemdup
Author: Julia Lawall <julia@diku.dk> Use kmemdup when some other buffer is immediately copied into the allocated region. A simplified version of the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // @@ expression from,to,size,flag; statement S; @@ – to = \(kmalloc\|kzalloc\)(size,flag); + to = kmemdup(from,size,flag); if (to==NULL || …) S – memcpy(to, from, …
May 15 2010
drivers/net/usb: Use kmemdup
Author: Julia Lawall <julia@diku.dk> Use kmemdup when some other buffer is immediately copied into the allocated region. A simplified version of the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // @@ expression from,to,size,flag; statement S; @@ – to = \(kmalloc\|kzalloc\)(size,flag); + to = kmemdup(from,size,flag); if (to==NULL || …) S – memcpy(to, from, …
May 15 2010
HID: picolcd: Eliminate use after free
Author: Julia Lawall <julia@diku.dk> The skip label frees resp, which has not been allocated at the point of this goto and then does a break, based on the fact that err is non-zero. This is replaced by a break directly. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) …
May 15 2010
[SCSI] aacraid: Eliminate use after free
Author: Julia Lawall <julia@diku.dk> The debugging code using the freed structure is moved before the kfree. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @free@ expression E; position p; @@ kfree@p(E) @@ expression free.E, subE
May 15 2010
drivers/char: Eliminate use after free
Author: Julia Lawall <julia@diku.dk> In each case, the first argument to send_control_msg or __send_control_msg, respectively, has either not been successfully allocated or has been freed at the point of the call. In the first case, the first argument, port, is only used to access the portdev and id fields, in order to call __send_control_msg. Thus …
