Messages in this thread Patch in this message | | | From | Colin King <> | Subject | [PATCH] usb: gadget: pch_udc: don't update td->next after it has been released to the pool | Date | Tue, 28 Mar 2017 13:28:50 +0100 |
| |
From: Colin Ian King <colin.king@canonical.com>
Writing to td->next should be avoided after td has been freed using dma_pool_free. The intent was to nullify the next pointer, but this is potentially dangerous once it is back in the pool. Remove it.
Detected by CoverityScan, CID#1091173 ("Write tp pointer after free")
Signed-off-by: Colin Ian King <colin.king@canonical.com> --- drivers/usb/gadget/udc/pch_udc.c | 1 - 1 file changed, 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c index 84dcbcd756f0..08bbe2c24134 100644 --- a/drivers/usb/gadget/udc/pch_udc.c +++ b/drivers/usb/gadget/udc/pch_udc.c @@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev, td = phys_to_virt(addr); addr2 = (dma_addr_t)td->next; dma_pool_free(dev->data_requests, td, addr); - td->next = 0x00; addr = addr2; } req->chain_len = 1; -- 2.11.0
| |