diff options
author | Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> | 2015-04-03 11:20:15 (GMT) |
---|---|---|
committer | Vinod Koul <vinod.koul@intel.com> | 2015-04-17 17:58:48 (GMT) |
commit | d7d8e892aa6fe280a2e2974d9fd1ec9253ee1a05 (patch) | |
tree | 332e18f29948518da896e908c98d781b7b5b734d | |
parent | 28591dfdd96c6289aebbf12d8eb4e5dc5ddbde97 (diff) | |
download | linux-d7d8e892aa6fe280a2e2974d9fd1ec9253ee1a05.tar.xz |
dmaengine: usb-dmac: Fix dereferencing freed memory 'desc'
This patch fixes an issue that the usb_dmac_desc_free() is
dereferencing freed memory 'desc' because it uses list_for_each_entry().
This function should use list_for_each_entry_safe().
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
-rw-r--r-- | drivers/dma/sh/usb-dmac.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c index d5dad98..f705798 100644 --- a/drivers/dma/sh/usb-dmac.c +++ b/drivers/dma/sh/usb-dmac.c @@ -285,13 +285,13 @@ static int usb_dmac_desc_alloc(struct usb_dmac_chan *chan, unsigned int sg_len, static void usb_dmac_desc_free(struct usb_dmac_chan *chan) { - struct usb_dmac_desc *desc; + struct usb_dmac_desc *desc, *_desc; LIST_HEAD(list); list_splice_init(&chan->desc_freed, &list); list_splice_init(&chan->desc_got, &list); - list_for_each_entry(desc, &list, node) { + list_for_each_entry_safe(desc, _desc, &list, node) { list_del(&desc->node); kfree(desc); } |