iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dmaengine: usb-dmac: Fix dereferencing freed memory 'desc'

Browse Source 
This patch fixes an issue that the usb_dmac_desc_free() is
dereferencing freed memory 'desc' because it uses list_for_each_entry().
This function should use list_for_each_entry_safe().

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
This commit is contained in:
Yoshihiro Shimoda 2015-04-03 20:20:15 +09:00 committed by Vinod Koul
parent 28591dfdd9
commit d7d8e892aa
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/dma/sh/usb-dmac.c
View File

@ -285,13 +285,13 @@ static int usb_dmac_desc_alloc(struct usb_dmac_chan *chan, unsigned int sg_len,
static void usb_dmac_desc_free(struct usb_dmac_chan *chan)
{
struct usb_dmac_desc *desc;
struct usb_dmac_desc *desc, *_desc;
LIST_HEAD(list);
list_splice_init(&chan->desc_freed, &list);
list_splice_init(&chan->desc_got, &list);
list_for_each_entry(desc, &list, node) {
list_for_each_entry_safe(desc, _desc, &list, node) {
list_del(&desc->node);
kfree(desc);
}