mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-31 08:28:13 +00:00
Code Issues Releases Wiki Activity

usb: gadget: udc: avoid use of freed pointer

Browse source 
Rewrite udc_free_dma_chain() function to avoid use of pointer after free.

Addresses-Coverity-ID: 1091172
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
This commit is contained in:
Gustavo A. R. Silva 2017-02-14 15:58:33 -06:00 committed by Felipe Balbi
parent dad3f793f2
commit 71ef322d06
1 changed files with 8 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
drivers/usb/gadget/udc/amd5536udc.c
View file

@ -611,21 +611,20 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp)
static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
{
int ret_val = 0;
struct udc_data_dma *td;
struct udc_data_dma *td_last = NULL;
struct udc_data_dma *td = req->td_data;
unsigned int i;
dma_addr_t addr_next = 0x00;
dma_addr_t addr = (dma_addr_t)td->next;
DBG(dev, "free chain req = %p\n", req);
/* do not free first desc., will be done by free for request */
td_last = req->td_data;
td = phys_to_virt(td_last->next);
for (i = 1; i < req->chain_len; i++) {
pci_pool_free(dev->data_requests, td,
(dma_addr_t)td_last->next);
td_last = td;
td = phys_to_virt(td_last->next);
td = phys_to_virt(addr);
addr_next = (dma_addr_t)td->next;
pci_pool_free(dev->data_requests, td, addr);
addr = addr_next;
}
return ret_val;