Re: [PATCH 2/3] usb/dummy_hcd: fix null-deref free req

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello.

On 25-01-2012 14:51, Sebastian Andrzej Siewior wrote:

_ep to ep is a pointer substraction so ep won't be zero unless _ep was
8. This was not intendent by the author, it was probably a typo while
checking for NULL of the argument.

Signed-off-by: Sebastian Andrzej Siewior<bigeasy@xxxxxxxxxxxxx>
---
  drivers/usb/gadget/dummy_hcd.c |    4 ++--
  1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index a4c4cc1..199290c 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -599,10 +599,10 @@ static void dummy_free_request(struct usb_ep *_ep, struct usb_request *_req)
  	struct dummy_ep		*ep;
  	struct dummy_request	*req;

-	ep = usb_ep_to_dummy_ep(_ep);
-	if (!ep || !_req || (!ep->desc && _ep->name != ep0name))
+	if (!_ep || !_req || (!ep->desc && _ep->name != ep0name))
                               ^^
   'ep' in not initialized now.

  		return;

+	ep = usb_ep_to_dummy_ep(_ep);
  	req = usb_request_to_dummy_request(_req);
  	WARN_ON(!list_empty(&req->queue));
  	kfree(req);

WBR, Sergei
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux