From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751993AbdBHVVm (ORCPT ); Wed, 8 Feb 2017 16:21:42 -0500 Received: from gateway30.websitewelcome.com ([50.116.127.1]:36543 "EHLO gateway30.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751338AbdBHVVk (ORCPT ); Wed, 8 Feb 2017 16:21:40 -0500 Date: Wed, 8 Feb 2017 13:15:49 -0600 From: "Gustavo A. R. Silva" To: gregkh@linuxfoundation.org, balbi@kernel.org, andriy.shevchenko@linux.intel.com, bhelgaas@google.com, heikki.krogerus@linux.intel.com, mail@iagoabal.eu, mina86@mina86.com Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] drivers: usb: gadget: udc: remove pointer dereference after free Message-ID: <20170208191549.GA3998@embeddedgus> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 187.192.77.148 X-Exim-ID: 1cbXiY-000RJE-6c X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (embeddedgus) [187.192.77.148]:33572 X-Source-Auth: garsilva@embeddedor.com X-Email-Count: 9 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Remove pointer dereference and write after free. Addresses-Coverity-ID: 1091173 Signed-off-by: Gustavo A. R. Silva --- drivers/usb/gadget/udc/pch_udc.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c index a97da64..8a365aa 100644 --- a/drivers/usb/gadget/udc/pch_udc.c +++ b/drivers/usb/gadget/udc/pch_udc.c @@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev, td = phys_to_virt(addr); addr2 = (dma_addr_t)td->next; pci_pool_free(dev->data_requests, td, addr); - td->next = 0x00; addr = addr2; } req->chain_len = 1; -- 2.5.0