Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1597147 > unrolled thread

Re: [PATCH v3] usb: gadget: udc: remove pointer dereference after free

Started byFelipe Balbi <balbi@kernel.org>
First post2017-03-10 12:40 +0100
Last post2017-03-10 22:40 +0100
Articles 3 — 2 participants

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.


Contents

  Re: [PATCH v3] usb: gadget: udc: remove pointer dereference after free Felipe Balbi <balbi@kernel.org> - 2017-03-10 12:40 +0100
    Re: [PATCH v3] usb: gadget: udc: remove pointer dereference after  free "Gustavo A. R. Silva" <garsilva@embeddedor.com> - 2017-03-10 22:30 +0100
      [PATCH v4] usb: gadget: udc: remove pointer dereference after free "Gustavo A. R. Silva" <garsilva@embeddedor.com> - 2017-03-10 22:40 +0100

#1597147 — Re: [PATCH v3] usb: gadget: udc: remove pointer dereference after free

FromFelipe Balbi <balbi@kernel.org>
Date2017-03-10 12:40 +0100
SubjectRe: [PATCH v3] usb: gadget: udc: remove pointer dereference after free
Message-ID<tjr3P-3kY-1@gated-at.bofh.it>

[Multipart message — attachments visible in raw view] — view raw

"Gustavo A. R. Silva" <garsilva@embeddedor.com> writes:

> Remove pointer dereference after free.
>
> Addresses-Coverity-ID: 1091173
> Acked-by: Michal Nazarewicz <mina86@mina86.com>
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
> ---
> Changes in v2:
>   Move pointer dereference before pci_pool_free()
>   Set pointer to NULL after free
>
> Changes in v3:
>   Remove 'td->next = 0x00' inside for loop.
>   Remove unnecessary pointer nullification after free.
>
>   drivers/usb/gadget/udc/pch_udc.c | 1 -
>   1 file changed, 1 deletion(-)
>
> diff --git a/drivers/usb/gadget/udc/pch_udc.c  
> b/drivers/usb/gadget/udc/pch_udc.c
> index a97da64..8a365aa 100644
> --- a/drivers/usb/gadget/udc/pch_udc.c
> +++ b/drivers/usb/gadget/udc/pch_udc.c
> @@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct  
> pch_udc_dev *dev,

line wrapped. Can't apply.

-- 
balbi

[toc] | [next] | [standalone]


#1598108 — Re: [PATCH v3] usb: gadget: udc: remove pointer dereference after free

From"Gustavo A. R. Silva" <garsilva@embeddedor.com>
Date2017-03-10 22:30 +0100
SubjectRe: [PATCH v3] usb: gadget: udc: remove pointer dereference after free
Message-ID<tjAgP-1eI-31@gated-at.bofh.it>
In reply to#1597147
Hello,

Quoting Felipe Balbi <balbi@kernel.org>:

> "Gustavo A. R. Silva" <garsilva@embeddedor.com> writes:
>
>> Remove pointer dereference after free.
>>
>> Addresses-Coverity-ID: 1091173
>> Acked-by: Michal Nazarewicz <mina86@mina86.com>
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>> ---
>> Changes in v2:
>>   Move pointer dereference before pci_pool_free()
>>   Set pointer to NULL after free
>>
>> Changes in v3:
>>   Remove 'td->next = 0x00' inside for loop.
>>   Remove unnecessary pointer nullification after free.
>>
>>   drivers/usb/gadget/udc/pch_udc.c | 1 -
>>   1 file changed, 1 deletion(-)
>>
>> diff --git a/drivers/usb/gadget/udc/pch_udc.c
>> b/drivers/usb/gadget/udc/pch_udc.c
>> index a97da64..8a365aa 100644
>> --- a/drivers/usb/gadget/udc/pch_udc.c
>> +++ b/drivers/usb/gadget/udc/pch_udc.c
>> @@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct
>> pch_udc_dev *dev,
>
> line wrapped. Can't apply.
>

I'll fix it right away.

Thanks
--
Gustavo A. R. Silva

[toc] | [prev] | [next] | [standalone]


#1598116 — [PATCH v4] usb: gadget: udc: remove pointer dereference after free

From"Gustavo A. R. Silva" <garsilva@embeddedor.com>
Date2017-03-10 22:40 +0100
Subject[PATCH v4] usb: gadget: udc: remove pointer dereference after free
Message-ID<tjAqt-1kb-3@gated-at.bofh.it>
In reply to#1598108
Remove pointer dereference after free.

Addresses-Coverity-ID: 1091173
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
Changes in v2:
 Move pointer dereference before pci_pool_free()
 Set pointer to NULL after free

Changes in v3:
 Remove 'td->next = 0x00' inside for loop.
 Remove unnecessary pointer nullification after free.

Changes in v4:
 Fix line-wrapping in previous patch.

 drivers/usb/gadget/udc/pch_udc.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index a97da64..8a365aa 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev,
 		td = phys_to_virt(addr);
 		addr2 = (dma_addr_t)td->next;
 		pci_pool_free(dev->data_requests, td, addr);
-		td->next = 0x00;
 		addr = addr2;
 	}
 	req->chain_len = 1;
-- 
2.5.0

[toc] | [prev] | [standalone]


Back to top | Article view | linux.kernel


csiph-web