Showing error 562

User: Jiri Slaby
Error type: Double Free
Error type description: Freeing function is called twice on the same address
File location: drivers/infiniband/core/uverbs_main.c
Line in file: 794
Project: Linux Kernel
Project version: 2.6.28
Tools: Stanse (1.2)
Entered: 2011-11-07 22:19:31 UTC

Source: 

764
765        uverbs_dev->dev = device_create(uverbs_class, device->dma_device,
766                                        uverbs_dev->cdev->dev, uverbs_dev,
767                                        "uverbs%d", uverbs_dev->devnum);
768        if (IS_ERR(uverbs_dev->dev))
769                goto err_cdev;
770
771        if (device_create_file(uverbs_dev->dev, &dev_attr_ibdev))
772                goto err_class;
773        if (device_create_file(uverbs_dev->dev, &dev_attr_abi_version))
774                goto err_class;
775
776        spin_lock(&map_lock);
777        dev_table[uverbs_dev->devnum] = uverbs_dev;
778        spin_unlock(&map_lock);
779
780        ib_set_client_data(device, &uverbs_client, uverbs_dev);
781
782        return;
783
784err_class:
785        device_destroy(uverbs_class, uverbs_dev->cdev->dev);
786
787err_cdev:
788        cdev_del(uverbs_dev->cdev);
789        clear_bit(uverbs_dev->devnum, dev_map);
790
791err:
792        kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
793        wait_for_completion(&uverbs_dev->comp);
794        kfree(uverbs_dev);
795        return;
796}
797
798static void ib_uverbs_remove_one(struct ib_device *device)
799{
800        struct ib_uverbs_device *uverbs_dev = ib_get_client_data(device, &uverbs_client);
801
802        if (!uverbs_dev)
803                return;
804
Show full sources
↑