diff options
| author | Paul Zimmerman <Paul.Zimmerman@synopsys.com> | 2013-11-23 04:43:46 +0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-11-25 23:59:57 +0400 |
| commit | fbd1cd202739558210fd8f441b36601b29050bf4 (patch) | |
| tree | 4da82b4a65ccbb0c258756e0e1b93e1afd0f039f | |
| parent | 9bda1aac6b98d79f06df4ae40711bf08d23e766d (diff) | |
| download | linux-fbd1cd202739558210fd8f441b36601b29050bf4.tar.xz | |
staging: dwc2: fix potential use after free
dwc2_process_non_isoc_desc() can potentially free the qtd, so null
out the qtd pointer if the call fails so we don't try to access it
later
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/dwc2/hcd_ddma.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/staging/dwc2/hcd_ddma.c b/drivers/staging/dwc2/hcd_ddma.c index c7d434519776..72e9788c1a13 100644 --- a/drivers/staging/dwc2/hcd_ddma.c +++ b/drivers/staging/dwc2/hcd_ddma.c @@ -1103,8 +1103,10 @@ static void dwc2_complete_non_isoc_xfer_ddma(struct dwc2_hsotg *hsotg, for (i = 0; i < qtd->n_desc; i++) { if (dwc2_process_non_isoc_desc(hsotg, chan, chnum, qtd, desc_num, halt_status, - &xfer_done)) + &xfer_done)) { + qtd = NULL; break; + } desc_num++; } } |