Commit 09d28d2c19 introduces set-after-free in arch/arm/mach-omap2/mcbsp.c

Hi,

commit 09d28d2c19fe5c2d51b3133329584166dec89f86

Author: Jarkko Nikula <[email protected]>
Date:   Mon Sep 26 10:45:48 2011 +0300

ARM: OMAP: mcbsp: Start generalize omap2_mcbsp_set_clks_src

...

contains (when displayed with "-U10"):

index 92bd5e2..3dd4c47 100644

....
@@ -181,20 +173,21 @@ static int omap_init_mcbsp(struct omap_hwmod *oh, void *unused)

        }
        pdev = omap_device_build_ss(name, id, oh_device, count, pdata,
                                sizeof(*pdata), omap2_mcbsp_latency,
                                ARRAY_SIZE(omap2_mcbsp_latency), false);
        kfree(pdata);
        if (IS_ERR(pdev))  {
                pr_err("%s: Can't build omap_device for %s:%s.\n", __func__,
                                        name, oh->name);
                return PTR_ERR(pdev);
        }
+       pdata->set_clk_src = omap2_mcbsp_set_clk_src;
        omap_mcbsp_count++;
        return 0;

}

static int __init omap2_mcbsp_init(void)

 {
        omap_hwmod_for_each_by_class("mcbsp", omap_init_mcbsp, NULL);
 
        mcbsp_ptr = kzalloc(omap_mcbsp_count * sizeof(struct omap_mcbsp *),
                                                                GFP_KERNEL);

which sets a field in pdata after it has been freed.

commit 7bc0c4bac72375517d904e02c46da2a23e079e8b

Author: Jarkko Nikula <[email protected]>
Date:   Mon Sep 26 10:45:49 2011 +0300

then adds

@@ -181,6 +184,8 @@ static int omap_init_mcbsp(struct omap_hwmod *oh, void *unused)

                return PTR_ERR(pdev);
        }
        pdata->set_clk_src = omap2_mcbsp_set_clk_src;
+       if (id == 1)
+               pdata->mux_signal = omap2_mcbsp1_mux_rx_clk;
        omap_mcbsp_count++;
        return 0;

}

which sets another field.

Should these settings just be moved up before the call to omap_device_build_ss?? Doing that removes

[    0.196014] Slab corruption: size-32 start=ded3edc0, len=32

warning.

Thanks,
NeilBrown

Good catch! Yes, they must be set before omap_device_build_ss and definitely before kfree. I just wonder how did I managed to put them after both. Perhaps my own rebasing error or just plain stupidity... I'll send a patch soon.

Jarkko