On Fri, 30 Aug 2013, Philippe De Swert wrote:
> When an error occurs adding a udc platform device there is a risk of an infinite loop.
> If more than one platform device was added i will remain >= than 0. The intention seems
> to clean up all the different already added platform devices before the failure occurs,
> so fixed the code to actually do so. We need to decrement first because the adding at the current
> index of i is the one that failed.
>
> At the same time the code is harmonized for hcd platform adding.
>
> Found with coverity : CID 751073
>
> Signed-off-by: Philippe De Swert <philippe.deswert@xxxxxxxxxxxxxxx>
> ---
> drivers/usb/gadget/dummy_hcd.c | 8 +++-----
> 1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
> index c588e8e..2e16c9a 100644
> --- a/drivers/usb/gadget/dummy_hcd.c
> +++ b/drivers/usb/gadget/dummy_hcd.c
> @@ -2684,9 +2684,8 @@ static int __init init(void)
> for (i = 0; i < mod_data.num; i++) {
> retval = platform_device_add(the_hcd_pdev[i]);
> if (retval < 0) {
> - i--;
> - while (i >= 0)
> - platform_device_del(the_hcd_pdev[i--]);
> + while (i-- >= 0)
> + platform_device_del(the_hcd_pdev[i]);
> goto err_add_hcd;
> }
> }
> @@ -2705,8 +2704,7 @@ static int __init init(void)
> for (i = 0; i < mod_data.num; i++) {
> retval = platform_device_add(the_udc_pdev[i]);
> if (retval < 0) {
> - i--;
> - while (i >= 0)
> + while (i-- >= 0)
> platform_device_del(the_udc_pdev[i]);
> goto err_add_udc;
> }
You used a post-decrement operator instead of pre-decrement. This
means the final iteration of the "while" loops will have i == -1 and
will crash.
Alan Stern
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
