From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934022AbdCJVjq (ORCPT ); Fri, 10 Mar 2017 16:39:46 -0500 Received: from gateway23.websitewelcome.com ([192.185.50.161]:29098 "EHLO gateway23.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932595AbdCJVji (ORCPT ); Fri, 10 Mar 2017 16:39:38 -0500 Date: Fri, 10 Mar 2017 15:39:32 -0600 From: "Gustavo A. R. Silva" To: Felipe Balbi Cc: Michal Nazarewicz , Andy Shevchenko , gregkh@linuxfoundation.org, heikki.krogerus@linux.intel.com, mail@iagoabal.eu, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Peter Senna Tschudin , "Gustavo A. R. Silva" Subject: [PATCH v4] usb: gadget: udc: remove pointer dereference after free Message-ID: <20170310213932.GA5340@embeddedgus> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170310152037.Horde.49bdIvAhaWSa41VTBWvs3xO@gator4166.hostgator.com> User-Agent: Mutt/1.5.23 (2014-03-12) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 189.207.49.133 X-Exim-ID: 1cmSG5-000Bpd-7I X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (embeddedgus) [189.207.49.133]:42020 X-Source-Auth: garsilva@embeddedor.com X-Email-Count: 18 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Remove pointer dereference after free. Addresses-Coverity-ID: 1091173 Acked-by: Michal Nazarewicz Signed-off-by: Gustavo A. R. Silva --- Changes in v2: Move pointer dereference before pci_pool_free() Set pointer to NULL after free Changes in v3: Remove 'td->next = 0x00' inside for loop. Remove unnecessary pointer nullification after free. Changes in v4: Fix line-wrapping in previous patch. drivers/usb/gadget/udc/pch_udc.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c index a97da64..8a365aa 100644 --- a/drivers/usb/gadget/udc/pch_udc.c +++ b/drivers/usb/gadget/udc/pch_udc.c @@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev, td = phys_to_virt(addr); addr2 = (dma_addr_t)td->next; pci_pool_free(dev->data_requests, td, addr); - td->next = 0x00; addr = addr2; } req->chain_len = 1; -- 2.5.0