* [PATCH 0/2] avoid use of freed pointer
@ 2017-02-13 15:37 Gustavo A. R. Silva
2017-02-13 15:40 ` [PATCH 1/2] usb: gadget: udc: " Gustavo A. R. Silva
2017-02-13 15:40 ` [PATCH 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype Gustavo A. R. Silva
0 siblings, 2 replies; 11+ messages in thread
From: Gustavo A. R. Silva @ 2017-02-13 15:37 UTC (permalink / raw)
To: balbi, gregkh, bhelgaas, mina86, heikki.krogerus
Cc: linux-geode, linux-usb, linux-kernel
Hello,
This patch series addesses Coverity ID 1091172, which reports the
use of a freed pointer. udc_free_dma_chain() function was rewritten
in order to fix this issue.
Unnecessary 'ret_val' variable was removed and the function prototype
was modified.
Thanks
Gustavo A. R. Silva (2):
usb: gadget: udc: avoid use of freed pointer
usb: gadget: udc: remove unnecessary variable and update function
prototype
drivers/usb/gadget/udc/amd5536udc.c | 25 ++++++++++++-------------
1 file changed, 12 insertions(+), 13 deletions(-)
--
2.5.0
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH 1/2] usb: gadget: udc: avoid use of freed pointer
2017-02-13 15:37 [PATCH 0/2] avoid use of freed pointer Gustavo A. R. Silva
@ 2017-02-13 15:40 ` Gustavo A. R. Silva
2017-02-13 16:06 ` Michal Nazarewicz
2017-02-13 15:40 ` [PATCH 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype Gustavo A. R. Silva
1 sibling, 1 reply; 11+ messages in thread
From: Gustavo A. R. Silva @ 2017-02-13 15:40 UTC (permalink / raw)
To: balbi, gregkh, bhelgaas, mina86, heikki.krogerus
Cc: linux-geode, linux-usb, linux-kernel
Rewrite udc_free_dma_chain() function to avoid use of pointer after free.
Addresses-Coverity-ID: 1091172
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
drivers/usb/gadget/udc/amd5536udc.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/usb/gadget/udc/amd5536udc.c b/drivers/usb/gadget/udc/amd5536udc.c
index ea03ca7..ded97a3 100644
--- a/drivers/usb/gadget/udc/amd5536udc.c
+++ b/drivers/usb/gadget/udc/amd5536udc.c
@@ -611,21 +611,23 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp)
static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
{
int ret_val = 0;
- struct udc_data_dma *td;
- struct udc_data_dma *td_last = NULL;
+ struct udc_data_dma *td = req->td_data;
unsigned int i;
+ dma_addr_t addr_aux = 0x00;
+ dma_addr_t addr = (dma_addr_t)td->next;
+ td->next = 0x00;
+
DBG(dev, "free chain req = %p\n", req);
/* do not free first desc., will be done by free for request */
- td_last = req->td_data;
- td = phys_to_virt(td_last->next);
-
for (i = 1; i < req->chain_len; i++) {
- pci_pool_free(dev->data_requests, td,
- (dma_addr_t)td_last->next);
- td_last = td;
- td = phys_to_virt(td_last->next);
+ td = phys_to_virt(addr);
+ addr_aux = (dma_addr_t)td->next;
+ td->next = 0x00;
+ pci_pool_free(dev->data_requests, td, addr);
+ td = NULL;
+ addr = addr_aux;
}
return ret_val;
--
2.5.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [PATCH 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype
2017-02-13 15:37 [PATCH 0/2] avoid use of freed pointer Gustavo A. R. Silva
2017-02-13 15:40 ` [PATCH 1/2] usb: gadget: udc: " Gustavo A. R. Silva
@ 2017-02-13 15:40 ` Gustavo A. R. Silva
2017-02-13 16:07 ` Michal Nazarewicz
1 sibling, 1 reply; 11+ messages in thread
From: Gustavo A. R. Silva @ 2017-02-13 15:40 UTC (permalink / raw)
To: balbi, gregkh, bhelgaas, mina86, heikki.krogerus
Cc: linux-geode, linux-usb, linux-kernel
Remove unnecessary variable and update function prototype.
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
drivers/usb/gadget/udc/amd5536udc.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/udc/amd5536udc.c b/drivers/usb/gadget/udc/amd5536udc.c
index ded97a3..3f64a06 100644
--- a/drivers/usb/gadget/udc/amd5536udc.c
+++ b/drivers/usb/gadget/udc/amd5536udc.c
@@ -608,9 +608,8 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp)
}
/* frees pci pool descriptors of a DMA chain */
-static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
+static void udc_free_dma_chain(struct udc *dev, struct udc_request *req)
{
- int ret_val = 0;
struct udc_data_dma *td = req->td_data;
unsigned int i;
@@ -629,8 +628,6 @@ static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
td = NULL;
addr = addr_aux;
}
-
- return ret_val;
}
/* Frees request packet, called by gadget driver */
--
2.5.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [PATCH 1/2] usb: gadget: udc: avoid use of freed pointer
2017-02-13 15:40 ` [PATCH 1/2] usb: gadget: udc: " Gustavo A. R. Silva
@ 2017-02-13 16:06 ` Michal Nazarewicz
2017-02-14 21:53 ` Gustavo A. R. Silva
0 siblings, 1 reply; 11+ messages in thread
From: Michal Nazarewicz @ 2017-02-13 16:06 UTC (permalink / raw)
To: Gustavo A. R. Silva, balbi, gregkh, bhelgaas, heikki.krogerus
Cc: linux-geode, linux-usb, linux-kernel
On Mon, Feb 13 2017, Gustavo A. R. Silva wrote:
> Rewrite udc_free_dma_chain() function to avoid use of pointer after free.
>
> Addresses-Coverity-ID: 1091172
> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
> ---
> drivers/usb/gadget/udc/amd5536udc.c | 20 +++++++++++---------
> 1 file changed, 11 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/usb/gadget/udc/amd5536udc.c b/drivers/usb/gadget/udc/amd5536udc.c
> index ea03ca7..ded97a3 100644
> --- a/drivers/usb/gadget/udc/amd5536udc.c
> +++ b/drivers/usb/gadget/udc/amd5536udc.c
> @@ -611,21 +611,23 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp)
> static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
> {
> int ret_val = 0;
> - struct udc_data_dma *td;
> - struct udc_data_dma *td_last = NULL;
> + struct udc_data_dma *td = req->td_data;
> unsigned int i;
>
> + dma_addr_t addr_aux = 0x00;
Perhaps call it ‘addr_next’ or ‘next’?
> + dma_addr_t addr = (dma_addr_t)td->next;
> + td->next = 0x00;
> +
> DBG(dev, "free chain req = %p\n", req);
>
> /* do not free first desc., will be done by free for request */
> - td_last = req->td_data;
> - td = phys_to_virt(td_last->next);
> -
> for (i = 1; i < req->chain_len; i++) {
> - pci_pool_free(dev->data_requests, td,
> - (dma_addr_t)td_last->next);
> - td_last = td;
> - td = phys_to_virt(td_last->next);
> + td = phys_to_virt(addr);
> + addr_aux = (dma_addr_t)td->next;
> + td->next = 0x00;
This is unnecessary.
> + pci_pool_free(dev->data_requests, td, addr);
> + td = NULL;
Ditto.
> + addr = addr_aux;
> }
>
> return ret_val;
> --
> 2.5.0
>
--
Best regards
ミハウ “𝓶𝓲𝓷𝓪86” ナザレヴイツ
«If at first you don’t succeed, give up skydiving»
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype
2017-02-13 15:40 ` [PATCH 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype Gustavo A. R. Silva
@ 2017-02-13 16:07 ` Michal Nazarewicz
0 siblings, 0 replies; 11+ messages in thread
From: Michal Nazarewicz @ 2017-02-13 16:07 UTC (permalink / raw)
To: Gustavo A. R. Silva, balbi, gregkh, bhelgaas, heikki.krogerus
Cc: linux-geode, linux-usb, linux-kernel
On Mon, Feb 13 2017, Gustavo A. R. Silva wrote:
> Remove unnecessary variable and update function prototype.
>
> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
> ---
> drivers/usb/gadget/udc/amd5536udc.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/drivers/usb/gadget/udc/amd5536udc.c b/drivers/usb/gadget/udc/amd5536udc.c
> index ded97a3..3f64a06 100644
> --- a/drivers/usb/gadget/udc/amd5536udc.c
> +++ b/drivers/usb/gadget/udc/amd5536udc.c
> @@ -608,9 +608,8 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp)
> }
>
> /* frees pci pool descriptors of a DMA chain */
> -static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
> +static void udc_free_dma_chain(struct udc *dev, struct udc_request *req)
> {
> - int ret_val = 0;
> struct udc_data_dma *td = req->td_data;
> unsigned int i;
>
> @@ -629,8 +628,6 @@ static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
> td = NULL;
> addr = addr_aux;
> }
> -
> - return ret_val;
> }
>
> /* Frees request packet, called by gadget driver */
> --
> 2.5.0
>
--
Best regards
ミハウ “𝓶𝓲𝓷𝓪86” ナザレヴイツ
«If at first you don’t succeed, give up skydiving»
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH 1/2] usb: gadget: udc: avoid use of freed pointer
2017-02-13 16:06 ` Michal Nazarewicz
@ 2017-02-14 21:53 ` Gustavo A. R. Silva
2017-02-14 21:58 ` [PATCH v2 " Gustavo A. R. Silva
2017-04-04 4:28 ` [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer Gustavo A. R. Silva
0 siblings, 2 replies; 11+ messages in thread
From: Gustavo A. R. Silva @ 2017-02-14 21:53 UTC (permalink / raw)
To: Michal Nazarewicz
Cc: balbi, gregkh, bhelgaas, heikki.krogerus, linux-geode, linux-usb,
linux-kernel
Hi Michal,
Quoting Michal Nazarewicz <mina86@mina86.com>:
> On Mon, Feb 13 2017, Gustavo A. R. Silva wrote:
>> Rewrite udc_free_dma_chain() function to avoid use of pointer after free.
>>
>> Addresses-Coverity-ID: 1091172
>> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>
> Acked-by: Michal Nazarewicz <mina86@mina86.com>
>
>> ---
>> drivers/usb/gadget/udc/amd5536udc.c | 20 +++++++++++---------
>> 1 file changed, 11 insertions(+), 9 deletions(-)
>>
>> diff --git a/drivers/usb/gadget/udc/amd5536udc.c
>> b/drivers/usb/gadget/udc/amd5536udc.c
>> index ea03ca7..ded97a3 100644
>> --- a/drivers/usb/gadget/udc/amd5536udc.c
>> +++ b/drivers/usb/gadget/udc/amd5536udc.c
>> @@ -611,21 +611,23 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp)
>> static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
>> {
>> int ret_val = 0;
>> - struct udc_data_dma *td;
>> - struct udc_data_dma *td_last = NULL;
>> + struct udc_data_dma *td = req->td_data;
>> unsigned int i;
>>
>> + dma_addr_t addr_aux = 0x00;
>
> Perhaps call it ‘addr_next’ or ‘next’?
>
>> + dma_addr_t addr = (dma_addr_t)td->next;
>> + td->next = 0x00;
>> +
>> DBG(dev, "free chain req = %p\n", req);
>>
>> /* do not free first desc., will be done by free for request */
>> - td_last = req->td_data;
>> - td = phys_to_virt(td_last->next);
>> -
>> for (i = 1; i < req->chain_len; i++) {
>> - pci_pool_free(dev->data_requests, td,
>> - (dma_addr_t)td_last->next);
>> - td_last = td;
>> - td = phys_to_virt(td_last->next);
>> + td = phys_to_virt(addr);
>> + addr_aux = (dma_addr_t)td->next;
>> + td->next = 0x00;
>
> This is unnecessary.
>
>> + pci_pool_free(dev->data_requests, td, addr);
>> + td = NULL;
>
> Ditto.
>
>> + addr = addr_aux;
>> }
>>
>> return ret_val;
>> --
>> 2.5.0
>>
>
Thanks for your comments, I will send version 2 shortly.
--
Gustavo A. R. Silva
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer
2017-02-14 21:53 ` Gustavo A. R. Silva
@ 2017-02-14 21:58 ` Gustavo A. R. Silva
2017-02-14 22:03 ` [PATCH v2 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype Gustavo A. R. Silva
2017-04-04 4:28 ` [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer Gustavo A. R. Silva
1 sibling, 1 reply; 11+ messages in thread
From: Gustavo A. R. Silva @ 2017-02-14 21:58 UTC (permalink / raw)
To: Michal Nazarewicz
Cc: balbi, gregkh, bhelgaas, heikki.krogerus, linux-geode, linux-usb,
linux-kernel, Gustavo A. R. Silva
Rewrite udc_free_dma_chain() function to avoid use of pointer after free.
Addresses-Coverity-ID: 1091172
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
Changes in v2:
Remove 'td->next = 0x00' inside for loop.
Remove unnecessary pointer nullification after free.
Rename variable addr_aux to addr_next.
drivers/usb/gadget/udc/amd5536udc.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/drivers/usb/gadget/udc/amd5536udc.c b/drivers/usb/gadget/udc/amd5536udc.c
index ea03ca7..821d088 100644
--- a/drivers/usb/gadget/udc/amd5536udc.c
+++ b/drivers/usb/gadget/udc/amd5536udc.c
@@ -611,21 +611,20 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp)
static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
{
int ret_val = 0;
- struct udc_data_dma *td;
- struct udc_data_dma *td_last = NULL;
+ struct udc_data_dma *td = req->td_data;
unsigned int i;
+ dma_addr_t addr_next = 0x00;
+ dma_addr_t addr = (dma_addr_t)td->next;
+
DBG(dev, "free chain req = %p\n", req);
/* do not free first desc., will be done by free for request */
- td_last = req->td_data;
- td = phys_to_virt(td_last->next);
-
for (i = 1; i < req->chain_len; i++) {
- pci_pool_free(dev->data_requests, td,
- (dma_addr_t)td_last->next);
- td_last = td;
- td = phys_to_virt(td_last->next);
+ td = phys_to_virt(addr);
+ addr_next = (dma_addr_t)td->next;
+ pci_pool_free(dev->data_requests, td, addr);
+ addr = addr_next;
}
return ret_val;
--
2.5.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [PATCH v2 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype
2017-02-14 21:58 ` [PATCH v2 " Gustavo A. R. Silva
@ 2017-02-14 22:03 ` Gustavo A. R. Silva
0 siblings, 0 replies; 11+ messages in thread
From: Gustavo A. R. Silva @ 2017-02-14 22:03 UTC (permalink / raw)
To: Michal Nazarewicz
Cc: balbi, gregkh, bhelgaas, heikki.krogerus, linux-geode, linux-usb,
linux-kernel, Gustavo A. R. Silva
Remove unnecessary variable and update function prototype.
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
Changes in v2:
None.
drivers/usb/gadget/udc/amd5536udc.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/udc/amd5536udc.c b/drivers/usb/gadget/udc/amd5536udc.c
index 821d088..67dd209 100644
--- a/drivers/usb/gadget/udc/amd5536udc.c
+++ b/drivers/usb/gadget/udc/amd5536udc.c
@@ -608,9 +608,8 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp)
}
/* frees pci pool descriptors of a DMA chain */
-static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
+static void udc_free_dma_chain(struct udc *dev, struct udc_request *req)
{
- int ret_val = 0;
struct udc_data_dma *td = req->td_data;
unsigned int i;
@@ -626,8 +625,6 @@ static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
pci_pool_free(dev->data_requests, td, addr);
addr = addr_next;
}
-
- return ret_val;
}
/* Frees request packet, called by gadget driver */
--
2.5.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer
2017-02-14 21:53 ` Gustavo A. R. Silva
2017-02-14 21:58 ` [PATCH v2 " Gustavo A. R. Silva
@ 2017-04-04 4:28 ` Gustavo A. R. Silva
2017-04-04 4:34 ` [PATCH v2 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype Gustavo A. R. Silva
2017-04-05 12:32 ` [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer Felipe Balbi
1 sibling, 2 replies; 11+ messages in thread
From: Gustavo A. R. Silva @ 2017-04-04 4:28 UTC (permalink / raw)
To: Michal Nazarewicz, balbi, gregkh, bhelgaas, heikki.krogerus
Cc: linux-geode, linux-usb, linux-kernel, Peter Senna Tschudin,
Gustavo A. R. Silva
Rewrite udc_free_dma_chain() function to avoid use of pointer after free.
Addresses-Coverity-ID: 1091172
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
Changes in v2:
Remove 'td->next = 0x00' inside for loop.
Remove unnecessary pointer nullification after free.
Rename variable addr_aux to addr_next.
drivers/usb/gadget/udc/amd5536udc.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/drivers/usb/gadget/udc/amd5536udc.c b/drivers/usb/gadget/udc/amd5536udc.c
index ea03ca7..821d088 100644
--- a/drivers/usb/gadget/udc/amd5536udc.c
+++ b/drivers/usb/gadget/udc/amd5536udc.c
@@ -611,21 +611,20 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp)
static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
{
int ret_val = 0;
- struct udc_data_dma *td;
- struct udc_data_dma *td_last = NULL;
+ struct udc_data_dma *td = req->td_data;
unsigned int i;
+ dma_addr_t addr_next = 0x00;
+ dma_addr_t addr = (dma_addr_t)td->next;
+
DBG(dev, "free chain req = %p\n", req);
/* do not free first desc., will be done by free for request */
- td_last = req->td_data;
- td = phys_to_virt(td_last->next);
-
for (i = 1; i < req->chain_len; i++) {
- pci_pool_free(dev->data_requests, td,
- (dma_addr_t)td_last->next);
- td_last = td;
- td = phys_to_virt(td_last->next);
+ td = phys_to_virt(addr);
+ addr_next = (dma_addr_t)td->next;
+ pci_pool_free(dev->data_requests, td, addr);
+ addr = addr_next;
}
return ret_val;
--
2.5.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [PATCH v2 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype
2017-04-04 4:28 ` [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer Gustavo A. R. Silva
@ 2017-04-04 4:34 ` Gustavo A. R. Silva
2017-04-05 12:32 ` [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer Felipe Balbi
1 sibling, 0 replies; 11+ messages in thread
From: Gustavo A. R. Silva @ 2017-04-04 4:34 UTC (permalink / raw)
To: Michal Nazarewicz, balbi, gregkh, bhelgaas, heikki.krogerus
Cc: linux-geode, linux-usb, linux-kernel, Peter Senna Tschudin,
Gustavo A. R. Silva
Remove unnecessary variable and update function prototype.
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
Changes in v2:
None.
drivers/usb/gadget/udc/amd5536udc.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/udc/amd5536udc.c b/drivers/usb/gadget/udc/amd5536udc.c
index 821d088..67dd209 100644
--- a/drivers/usb/gadget/udc/amd5536udc.c
+++ b/drivers/usb/gadget/udc/amd5536udc.c
@@ -608,9 +608,8 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp)
}
/* frees pci pool descriptors of a DMA chain */
-static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
+static void udc_free_dma_chain(struct udc *dev, struct udc_request *req)
{
- int ret_val = 0;
struct udc_data_dma *td = req->td_data;
unsigned int i;
@@ -626,8 +625,6 @@ static int udc_free_dma_chain(struct udc *dev, struct udc_request *req)
pci_pool_free(dev->data_requests, td, addr);
addr = addr_next;
}
-
- return ret_val;
}
/* Frees request packet, called by gadget driver */
--
2.5.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer
2017-04-04 4:28 ` [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer Gustavo A. R. Silva
2017-04-04 4:34 ` [PATCH v2 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype Gustavo A. R. Silva
@ 2017-04-05 12:32 ` Felipe Balbi
1 sibling, 0 replies; 11+ messages in thread
From: Felipe Balbi @ 2017-04-05 12:32 UTC (permalink / raw)
To: Gustavo A. R. Silva, Michal Nazarewicz, gregkh, bhelgaas,
heikki.krogerus
Cc: linux-geode, linux-usb, linux-kernel, Peter Senna Tschudin,
Gustavo A. R. Silva
[-- Attachment #1: Type: text/plain, Size: 423 bytes --]
Hi,
"Gustavo A. R. Silva" <garsilva@embeddedor.com> writes:
> Rewrite udc_free_dma_chain() function to avoid use of pointer after free.
>
> Addresses-Coverity-ID: 1091172
> Acked-by: Michal Nazarewicz <mina86@mina86.com>
> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
doesn't apply to testing/next. Care to rebase?
--
balbi
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2017-04-05 12:33 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-13 15:37 [PATCH 0/2] avoid use of freed pointer Gustavo A. R. Silva
2017-02-13 15:40 ` [PATCH 1/2] usb: gadget: udc: " Gustavo A. R. Silva
2017-02-13 16:06 ` Michal Nazarewicz
2017-02-14 21:53 ` Gustavo A. R. Silva
2017-02-14 21:58 ` [PATCH v2 " Gustavo A. R. Silva
2017-02-14 22:03 ` [PATCH v2 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype Gustavo A. R. Silva
2017-04-04 4:28 ` [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer Gustavo A. R. Silva
2017-04-04 4:34 ` [PATCH v2 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype Gustavo A. R. Silva
2017-04-05 12:32 ` [PATCH v2 1/2] usb: gadget: udc: avoid use of freed pointer Felipe Balbi
2017-02-13 15:40 ` [PATCH 2/2] usb: gadget: udc: remove unnecessary variable and update function prototype Gustavo A. R. Silva
2017-02-13 16:07 ` Michal Nazarewicz
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).