From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933056AbdC1Mwf (ORCPT ); Tue, 28 Mar 2017 08:52:35 -0400 Received: from mga14.intel.com ([192.55.52.115]:58362 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932306AbdC1Mw2 (ORCPT ); Tue, 28 Mar 2017 08:52:28 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.36,236,1486454400"; d="scan'208";a="1147900679" From: Felipe Balbi To: Colin King , Greg Kroah-Hartman , Andy Shevchenko , Michal Nazarewicz , "Gustavo A . R . Silva" , Iago Abal , Romain Perier , linux-usb@vger.kernel.org Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] usb: gadget: pch_udc: don't update td->next after it has been released to the pool In-Reply-To: <20170328122850.18819-1-colin.king@canonical.com> References: <20170328122850.18819-1-colin.king@canonical.com> Date: Tue, 28 Mar 2017 15:51:21 +0300 Message-ID: <878tnph8dy.fsf@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, Colin King writes: > From: Colin Ian King > > Writing to td->next should be avoided after td has been freed using > dma_pool_free. The intent was to nullify the next pointer, but this > is potentially dangerous once it is back in the pool. Remove it. > > Detected by CoverityScan, CID#1091173 ("Write tp pointer after free") > > Signed-off-by: Colin Ian King > --- > drivers/usb/gadget/udc/pch_udc.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c > index 84dcbcd756f0..08bbe2c24134 100644 > --- a/drivers/usb/gadget/udc/pch_udc.c > +++ b/drivers/usb/gadget/udc/pch_udc.c > @@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev, > td = phys_to_virt(addr); > addr2 = (dma_addr_t)td->next; > dma_pool_free(dev->data_requests, td, addr); > - td->next = 0x00; I already have a patch for this, thanks 1f459262b0e1649a1e5ad12fa4c66eb76c2220ce Author: Gustavo A. R. Silva AuthorDate: Fri Mar 10 15:39:32 2017 -0600 Commit: Felipe Balbi CommitDate: Wed Mar 22 11:21:10 2017 +0200 usb: gadget: udc: remove pointer dereference after free Remove pointer dereference after free. Addresses-Coverity-ID: 1091173 Acked-by: Michal Nazarewicz Signed-off-by: Gustavo A. R. Silva Signed-off-by: Felipe Balbi 1 file changed, 1 deletion(-) drivers/usb/gadget/udc/pch_udc.c | 1 - modified drivers/usb/gadget/udc/pch_udc.c @@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev, td = phys_to_virt(addr); addr2 = (dma_addr_t)td->next; pci_pool_free(dev->data_requests, td, addr); - td->next = 0x00; addr = addr2; } req->chain_len = 1; -- balbi