* [PATCH] usb: gadget: pch_udc: don't update td->next after it has been released to the pool
@ 2017-03-28 12:28 Colin King
2017-03-28 12:51 ` Felipe Balbi
0 siblings, 1 reply; 3+ messages in thread
From: Colin King @ 2017-03-28 12:28 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Andy Shevchenko,
Michal Nazarewicz, Gustavo A . R . Silva, Iago Abal,
Romain Perier, linux-usb
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
Writing to td->next should be avoided after td has been freed using
dma_pool_free. The intent was to nullify the next pointer, but this
is potentially dangerous once it is back in the pool. Remove it.
Detected by CoverityScan, CID#1091173 ("Write tp pointer after free")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/usb/gadget/udc/pch_udc.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index 84dcbcd756f0..08bbe2c24134 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev,
td = phys_to_virt(addr);
addr2 = (dma_addr_t)td->next;
dma_pool_free(dev->data_requests, td, addr);
- td->next = 0x00;
addr = addr2;
}
req->chain_len = 1;
--
2.11.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] usb: gadget: pch_udc: don't update td->next after it has been released to the pool
2017-03-28 12:28 [PATCH] usb: gadget: pch_udc: don't update td->next after it has been released to the pool Colin King
@ 2017-03-28 12:51 ` Felipe Balbi
2017-03-28 12:52 ` Colin Ian King
0 siblings, 1 reply; 3+ messages in thread
From: Felipe Balbi @ 2017-03-28 12:51 UTC (permalink / raw)
To: Colin King, Greg Kroah-Hartman, Andy Shevchenko,
Michal Nazarewicz, Gustavo A . R . Silva, Iago Abal,
Romain Perier, linux-usb
Cc: kernel-janitors, linux-kernel
Hi,
Colin King <colin.king@canonical.com> writes:
> From: Colin Ian King <colin.king@canonical.com>
>
> Writing to td->next should be avoided after td has been freed using
> dma_pool_free. The intent was to nullify the next pointer, but this
> is potentially dangerous once it is back in the pool. Remove it.
>
> Detected by CoverityScan, CID#1091173 ("Write tp pointer after free")
>
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
> drivers/usb/gadget/udc/pch_udc.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
> index 84dcbcd756f0..08bbe2c24134 100644
> --- a/drivers/usb/gadget/udc/pch_udc.c
> +++ b/drivers/usb/gadget/udc/pch_udc.c
> @@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev,
> td = phys_to_virt(addr);
> addr2 = (dma_addr_t)td->next;
> dma_pool_free(dev->data_requests, td, addr);
> - td->next = 0x00;
I already have a patch for this, thanks
1f459262b0e1649a1e5ad12fa4c66eb76c2220ce
Author: Gustavo A. R. Silva <garsilva@embeddedor.com>
AuthorDate: Fri Mar 10 15:39:32 2017 -0600
Commit: Felipe Balbi <felipe.balbi@linux.intel.com>
CommitDate: Wed Mar 22 11:21:10 2017 +0200
usb: gadget: udc: remove pointer dereference after free
Remove pointer dereference after free.
Addresses-Coverity-ID: 1091173
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
1 file changed, 1 deletion(-)
drivers/usb/gadget/udc/pch_udc.c | 1 -
modified drivers/usb/gadget/udc/pch_udc.c
@@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev,
td = phys_to_virt(addr);
addr2 = (dma_addr_t)td->next;
pci_pool_free(dev->data_requests, td, addr);
- td->next = 0x00;
addr = addr2;
}
req->chain_len = 1;
--
balbi
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] usb: gadget: pch_udc: don't update td->next after it has been released to the pool
2017-03-28 12:51 ` Felipe Balbi
@ 2017-03-28 12:52 ` Colin Ian King
0 siblings, 0 replies; 3+ messages in thread
From: Colin Ian King @ 2017-03-28 12:52 UTC (permalink / raw)
To: Felipe Balbi, Greg Kroah-Hartman, Andy Shevchenko,
Michal Nazarewicz, Gustavo A . R . Silva, Iago Abal,
Romain Perier, linux-usb
Cc: kernel-janitors, linux-kernel
On 28/03/17 13:51, Felipe Balbi wrote:
>
> Hi,
>
> Colin King <colin.king@canonical.com> writes:
>> From: Colin Ian King <colin.king@canonical.com>
>>
>> Writing to td->next should be avoided after td has been freed using
>> dma_pool_free. The intent was to nullify the next pointer, but this
>> is potentially dangerous once it is back in the pool. Remove it.
>>
>> Detected by CoverityScan, CID#1091173 ("Write tp pointer after free")
>>
>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
>> ---
>> drivers/usb/gadget/udc/pch_udc.c | 1 -
>> 1 file changed, 1 deletion(-)
>>
>> diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
>> index 84dcbcd756f0..08bbe2c24134 100644
>> --- a/drivers/usb/gadget/udc/pch_udc.c
>> +++ b/drivers/usb/gadget/udc/pch_udc.c
>> @@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev,
>> td = phys_to_virt(addr);
>> addr2 = (dma_addr_t)td->next;
>> dma_pool_free(dev->data_requests, td, addr);
>> - td->next = 0x00;
>
> I already have a patch for this, thanks
Ah, I somehow overlooked that. Good to see it is fixed.
Colin
>
> 1f459262b0e1649a1e5ad12fa4c66eb76c2220ce
> Author: Gustavo A. R. Silva <garsilva@embeddedor.com>
> AuthorDate: Fri Mar 10 15:39:32 2017 -0600
> Commit: Felipe Balbi <felipe.balbi@linux.intel.com>
> CommitDate: Wed Mar 22 11:21:10 2017 +0200
>
> usb: gadget: udc: remove pointer dereference after free
>
> Remove pointer dereference after free.
>
> Addresses-Coverity-ID: 1091173
> Acked-by: Michal Nazarewicz <mina86@mina86.com>
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
>
> 1 file changed, 1 deletion(-)
> drivers/usb/gadget/udc/pch_udc.c | 1 -
>
> modified drivers/usb/gadget/udc/pch_udc.c
> @@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev,
> td = phys_to_virt(addr);
> addr2 = (dma_addr_t)td->next;
> pci_pool_free(dev->data_requests, td, addr);
> - td->next = 0x00;
> addr = addr2;
> }
> req->chain_len = 1;
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-03-28 12:52 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-03-28 12:28 [PATCH] usb: gadget: pch_udc: don't update td->next after it has been released to the pool Colin King
2017-03-28 12:51 ` Felipe Balbi
2017-03-28 12:52 ` Colin Ian King
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox