hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

usb: gadget: udc: avoid use of freed pointer 

Rewrite udc_free_dma_chain() function to avoid use of pointer after free.

Addresses-Coverity-ID: 1091172
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
This commit is contained in:
Gustavo A. R. Silva 2017-02-14 15:58:33 -06:00 committed by Felipe Balbi
parent dad3f793f2
commit 71ef322d06
1 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/usb/gadget/udc/amd5536udc.c
View File

@ -611,21 +611,20 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp)
static int udc_free_dma_chain(struct udc *dev, struct udc_request *req) static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
{ {
int ret_val = 0; int ret_val = 0;
struct udc_data_dma *td; struct udc_data_dma *td = req->td_data;
struct udc_data_dma *td_last = NULL;
unsigned int i; unsigned int i;
dma_addr_t addr_next = 0x00;
dma_addr_t addr = (dma_addr_t)td->next;
DBG(dev, "free chain req = %p\n", req); DBG(dev, "free chain req = %p\n", req);
/* do not free first desc., will be done by free for request */ /* do not free first desc., will be done by free for request */
td_last = req->td_data;
td = phys_to_virt(td_last->next);
for (i = 1; i < req->chain_len; i++) { for (i = 1; i < req->chain_len; i++) {
pci_pool_free(dev->data_requests, td, td = phys_to_virt(addr);
(dma_addr_t)td_last->next); addr_next = (dma_addr_t)td->next;
td_last = td; pci_pool_free(dev->data_requests, td, addr);
td = phys_to_virt(td_last->next); addr = addr_next;
} }
return ret_val; return ret_val;