Re: [PATCH 2/3 v2] usb/dummy_hcd: fix null-deref free req

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, 25 Jan 2012, Sebastian Andrzej Siewior wrote:

> _ep to ep is a pointer substraction so ep won't be zero unless _ep was
> 8. This was not intendent by the author, it was probably a typo while
> checking for NULL of the argument.
> 
> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
> ---
> v1..v2: avoid using unitilied ep in the test.
> 
>  drivers/usb/gadget/dummy_hcd.c |    4 +++-
>  1 files changed, 3 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
> index a4c4cc1..4141b27 100644
> --- a/drivers/usb/gadget/dummy_hcd.c
> +++ b/drivers/usb/gadget/dummy_hcd.c
> @@ -599,8 +599,10 @@ static void dummy_free_request(struct usb_ep *_ep, struct usb_request *_req)
>  	struct dummy_ep		*ep;
>  	struct dummy_request	*req;
>  
> +	if (!_ep || !_req)
> +		return;
>  	ep = usb_ep_to_dummy_ep(_ep);
> -	if (!ep || !_req || (!ep->desc && _ep->name != ep0name))
> +	if (!ep->desc && _ep->name != ep0name)
>  		return;
>  
>  	req = usb_request_to_dummy_request(_req);

It would have been sufficient to change !ep in the original statement 
to !_ep.  But this is okay too.

Acked-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux