From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751335AbdBNV6l (ORCPT ); Tue, 14 Feb 2017 16:58:41 -0500 Received: from gateway20.websitewelcome.com ([192.185.49.40]:33483 "EHLO gateway20.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751289AbdBNV6j (ORCPT ); Tue, 14 Feb 2017 16:58:39 -0500 Date: Tue, 14 Feb 2017 15:58:33 -0600 From: "Gustavo A. R. Silva" To: Michal Nazarewicz Cc: balbi@kernel.org, gregkh@linuxfoundation.org, bhelgaas@google.com, heikki.krogerus@linux.intel.com, linux-geode@lists.infradead.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, "Gustavo A. R. Silva" Subject: [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer Message-ID: <20170214215833.GA6169@embeddedgus> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170214155351.Horde.RbjzVc4YaibN9ftOcW_ubLW@webmail.embeddedor.com> User-Agent: Mutt/1.5.23 (2014-03-12) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 187.162.253.171 X-Exim-ID: 1cdl7J-000BYf-Hr X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: 187-162-253-171.static.axtel.net (embeddedgus) [187.162.253.171]:55024 X-Source-Auth: garsilva@embeddedor.com X-Email-Count: 16 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Rewrite udc_free_dma_chain() function to avoid use of pointer after free. Addresses-Coverity-ID: 1091172 Acked-by: Michal Nazarewicz Reviewed-by: Greg Kroah-Hartman Signed-off-by: Gustavo A. R. Silva --- Changes in v2: Remove 'td->next = 0x00' inside for loop. Remove unnecessary pointer nullification after free. Rename variable addr_aux to addr_next. drivers/usb/gadget/udc/amd5536udc.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/drivers/usb/gadget/udc/amd5536udc.c b/drivers/usb/gadget/udc/amd5536udc.c index ea03ca7..821d088 100644 --- a/drivers/usb/gadget/udc/amd5536udc.c +++ b/drivers/usb/gadget/udc/amd5536udc.c @@ -611,21 +611,20 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp) static int udc_free_dma_chain(struct udc *dev, struct udc_request *req) { int ret_val = 0; - struct udc_data_dma *td; - struct udc_data_dma *td_last = NULL; + struct udc_data_dma *td = req->td_data; unsigned int i; + dma_addr_t addr_next = 0x00; + dma_addr_t addr = (dma_addr_t)td->next; + DBG(dev, "free chain req = %p\n", req); /* do not free first desc., will be done by free for request */ - td_last = req->td_data; - td = phys_to_virt(td_last->next); - for (i = 1; i < req->chain_len; i++) { - pci_pool_free(dev->data_requests, td, - (dma_addr_t)td_last->next); - td_last = td; - td = phys_to_virt(td_last->next); + td = phys_to_virt(addr); + addr_next = (dma_addr_t)td->next; + pci_pool_free(dev->data_requests, td, addr); + addr = addr_next; } return ret_val; -- 2.5.0