Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751818AbdDDEwy (ORCPT ); Tue, 4 Apr 2017 00:52:54 -0400 Received: from gateway20.websitewelcome.com ([192.185.54.2]:17013 "EHLO gateway20.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751068AbdDDEwx (ORCPT ); Tue, 4 Apr 2017 00:52:53 -0400 X-Greylist: delayed 1441 seconds by postgrey-1.27 at vger.kernel.org; Tue, 04 Apr 2017 00:52:52 EDT Date: Mon, 3 Apr 2017 23:28:46 -0500 From: "Gustavo A. R. Silva" To: Michal Nazarewicz , balbi@kernel.org, gregkh@linuxfoundation.org, bhelgaas@google.com, heikki.krogerus@linux.intel.com Cc: linux-geode@lists.infradead.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Peter Senna Tschudin , "Gustavo A. R. Silva" Subject: [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer Message-ID: <20170404042846.GA15984@embeddedgus> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170214155351.Horde.RbjzVc4YaibN9ftOcW_ubLW@webmail.embeddedor.com> User-Agent: Mutt/1.5.23 (2014-03-12) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 189.152.147.203 X-Exim-ID: 1cvG5G-0006BF-Uq X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (embeddedgus) [189.152.147.203]:57674 X-Source-Auth: garsilva@embeddedor.com X-Email-Count: 9 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1631 Lines: 51 Rewrite udc_free_dma_chain() function to avoid use of pointer after free. Addresses-Coverity-ID: 1091172 Acked-by: Michal Nazarewicz Reviewed-by: Greg Kroah-Hartman Signed-off-by: Gustavo A. R. Silva --- Changes in v2: Remove 'td->next = 0x00' inside for loop. Remove unnecessary pointer nullification after free. Rename variable addr_aux to addr_next. drivers/usb/gadget/udc/amd5536udc.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/drivers/usb/gadget/udc/amd5536udc.c b/drivers/usb/gadget/udc/amd5536udc.c index ea03ca7..821d088 100644 --- a/drivers/usb/gadget/udc/amd5536udc.c +++ b/drivers/usb/gadget/udc/amd5536udc.c @@ -611,21 +611,20 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp) static int udc_free_dma_chain(struct udc *dev, struct udc_request *req) { int ret_val = 0; - struct udc_data_dma *td; - struct udc_data_dma *td_last = NULL; + struct udc_data_dma *td = req->td_data; unsigned int i; + dma_addr_t addr_next = 0x00; + dma_addr_t addr = (dma_addr_t)td->next; + DBG(dev, "free chain req = %p\n", req); /* do not free first desc., will be done by free for request */ - td_last = req->td_data; - td = phys_to_virt(td_last->next); - for (i = 1; i < req->chain_len; i++) { - pci_pool_free(dev->data_requests, td, - (dma_addr_t)td_last->next); - td_last = td; - td = phys_to_virt(td_last->next); + td = phys_to_virt(addr); + addr_next = (dma_addr_t)td->next; + pci_pool_free(dev->data_requests, td, addr); + addr = addr_next; } return ret_val; -- 2.5.0