From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753674AbdBNVyB (ORCPT ); Tue, 14 Feb 2017 16:54:01 -0500 Received: from gateway22.websitewelcome.com ([192.185.47.65]:26726 "EHLO gateway22.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753597AbdBNVx5 (ORCPT ); Tue, 14 Feb 2017 16:53:57 -0500 Date: Tue, 14 Feb 2017 15:53:51 -0600 Message-ID: <20170214155351.Horde.RbjzVc4YaibN9ftOcW_ubLW@webmail.embeddedor.com> From: "Gustavo A. R. Silva" To: Michal Nazarewicz Cc: balbi@kernel.org, gregkh@linuxfoundation.org, bhelgaas@google.com, heikki.krogerus@linux.intel.com, linux-geode@lists.infradead.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 1/2] usb: gadget: udc: avoid use of freed pointer References: <0c06bad2c5454514ea6105de030374348abd7408.1486867169.git.garsilva@embeddedor.com> In-Reply-To: User-Agent: Horde Application Framework 5 Content-Type: text/plain; charset=utf-8; format=flowed; DelSp=Yes MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 8bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 108.167.133.22 X-Exim-ID: 1cdl2l-0008Ed-IM X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: gator4166.hostgator.com [108.167.133.22]:43730 X-Source-Auth: garsilva@embeddedor.com X-Email-Count: 1 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Michal, Quoting Michal Nazarewicz : > On Mon, Feb 13 2017, Gustavo A. R. Silva wrote: >> Rewrite udc_free_dma_chain() function to avoid use of pointer after free. >> >> Addresses-Coverity-ID: 1091172 >> Reviewed-by: Greg Kroah-Hartman >> Signed-off-by: Gustavo A. R. Silva > > Acked-by: Michal Nazarewicz > >> --- >> drivers/usb/gadget/udc/amd5536udc.c | 20 +++++++++++--------- >> 1 file changed, 11 insertions(+), 9 deletions(-) >> >> diff --git a/drivers/usb/gadget/udc/amd5536udc.c >> b/drivers/usb/gadget/udc/amd5536udc.c >> index ea03ca7..ded97a3 100644 >> --- a/drivers/usb/gadget/udc/amd5536udc.c >> +++ b/drivers/usb/gadget/udc/amd5536udc.c >> @@ -611,21 +611,23 @@ udc_alloc_request(struct usb_ep *usbep, gfp_t gfp) >> static int udc_free_dma_chain(struct udc *dev, struct udc_request *req) >> { >> int ret_val = 0; >> - struct udc_data_dma *td; >> - struct udc_data_dma *td_last = NULL; >> + struct udc_data_dma *td = req->td_data; >> unsigned int i; >> >> + dma_addr_t addr_aux = 0x00; > > Perhaps call it ‘addr_next’ or ‘next’? > >> + dma_addr_t addr = (dma_addr_t)td->next; >> + td->next = 0x00; >> + >> DBG(dev, "free chain req = %p\n", req); >> >> /* do not free first desc., will be done by free for request */ >> - td_last = req->td_data; >> - td = phys_to_virt(td_last->next); >> - >> for (i = 1; i < req->chain_len; i++) { >> - pci_pool_free(dev->data_requests, td, >> - (dma_addr_t)td_last->next); >> - td_last = td; >> - td = phys_to_virt(td_last->next); >> + td = phys_to_virt(addr); >> + addr_aux = (dma_addr_t)td->next; >> + td->next = 0x00; > > This is unnecessary. > >> + pci_pool_free(dev->data_requests, td, addr); >> + td = NULL; > > Ditto. > >> + addr = addr_aux; >> } >> >> return ret_val; >> -- >> 2.5.0 >> > Thanks for your comments, I will send version 2 shortly. -- Gustavo A. R. Silva