diff options
| author | Gustavo A. R. Silva <garsilva@embeddedor.com> | 2017-02-14 15:58:33 -0600 |
|---|---|---|
| committer | Felipe Balbi <felipe.balbi@linux.intel.com> | 2017-04-11 10:58:17 +0300 |
| commit | 71ef322d0669785ded30cf389e81b720dda7c82a (patch) | |
| tree | 0f4e86044de30598e1a6dfa83b3a4787ad7bec6c | |
| parent | dad3f793f20fbb5c0c342f0f5a0bdf69a4d76089 (diff) | |
usb: gadget: udc: avoid use of freed pointer
Rewrite udc_free_dma_chain() function to avoid use of pointer after free.
Addresses-Coverity-ID: 1091172
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| -rw-r--r-- | drivers/usb/gadget/udc/amd5536udc.c | 17 |
1 files changed, 8 insertions, 9 deletions
diff --git a/drivers/usb/gadget/udc/amd5536udc.c b/drivers/usb/gadget/udc/amd5536udc.c index ea03ca7ae29a..821d088d1167 100644 --- a/drivers/usb/gadget/udc/amd5536udc.c +++ b/drivers/usb/gadget/udc/amd5536udc.c @@ -611,21 +611,20 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp) static int udc_free_dma_chain(struct udc *dev, struct udc_request *req) { int ret_val = 0; - struct udc_data_dma *td; - struct udc_data_dma *td_last = NULL; + struct udc_data_dma *td = req->td_data; unsigned int i; + dma_addr_t addr_next = 0x00; + dma_addr_t addr = (dma_addr_t)td->next; + DBG(dev, "free chain req = %p\n", req); /* do not free first desc., will be done by free for request */ - td_last = req->td_data; - td = phys_to_virt(td_last->next); - for (i = 1; i < req->chain_len; i++) { - pci_pool_free(dev->data_requests, td, - (dma_addr_t)td_last->next); - td_last = td; - td = phys_to_virt(td_last->next); + td = phys_to_virt(addr); + addr_next = (dma_addr_t)td->next; + pci_pool_free(dev->data_requests, td, addr); + addr = addr_next; } return ret_val; |