From patchwork Fri Apr 3 11:20:15 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoshihiro Shimoda X-Patchwork-Id: 6155981 Return-Path: X-Original-To: patchwork-dmaengine@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id B40E7BF4A6 for ; Fri, 3 Apr 2015 11:20:31 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A6CE5202E5 for ; Fri, 3 Apr 2015 11:20:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 61C2120259 for ; Fri, 3 Apr 2015 11:20:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751953AbbDCLU2 (ORCPT ); Fri, 3 Apr 2015 07:20:28 -0400 Received: from relmlor2.renesas.com ([210.160.252.172]:27070 "EHLO relmlie1.idc.renesas.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751702AbbDCLU2 (ORCPT ); Fri, 3 Apr 2015 07:20:28 -0400 Received: from unknown (HELO relmlir3.idc.renesas.com) ([10.200.68.153]) by relmlie1.idc.renesas.com with ESMTP; 03 Apr 2015 20:20:26 +0900 Received: from relmlac1.idc.renesas.com (relmlac1.idc.renesas.com [10.200.69.21]) by relmlir3.idc.renesas.com (Postfix) with ESMTP id 79F934676D; Fri, 3 Apr 2015 20:20:26 +0900 (JST) Received: by relmlac1.idc.renesas.com (Postfix, from userid 0) id 748868002E; Fri, 3 Apr 2015 20:20:26 +0900 (JST) Received: from relmlac1.idc.renesas.com (localhost [127.0.0.1]) by relmlac1.idc.renesas.com (Postfix) with ESMTP id 6E16C8002D; Fri, 3 Apr 2015 20:20:26 +0900 (JST) Received: from relmlii2.idc.renesas.com [10.200.68.66] by relmlac1.idc.renesas.com with ESMTP id WAB04116; Fri, 3 Apr 2015 20:20:26 +0900 X-IronPort-AV: E=Sophos;i="5.11,517,1422889200"; d="scan'208";a="184483055" Received: from mail-sg1lp0087.outbound.protection.outlook.com (HELO APAC01-SG1-obe.outbound.protection.outlook.com) ([207.46.51.87]) by relmlii2.idc.renesas.com with ESMTP/TLS/AES256-SHA; 03 Apr 2015 20:20:25 +0900 Received: from localhost (211.11.155.147) by HKXPR06MB325.apcprd06.prod.outlook.com (10.141.133.15) with Microsoft SMTP Server (TLS) id 15.1.130.23; Fri, 3 Apr 2015 11:20:23 +0000 From: Yoshihiro Shimoda To: , CC: , , Yoshihiro Shimoda Subject: [PATCH] dmaengine: usb-dmac: Fix dereferencing freed memory 'desc' Date: Fri, 3 Apr 2015 20:20:15 +0900 Message-ID: <1428060015-2896-1-git-send-email-yoshihiro.shimoda.uh@renesas.com> X-Mailer: git-send-email 1.9.4.msysgit.1 MIME-Version: 1.0 X-Originating-IP: [211.11.155.147] X-ClientProxiedBy: OS2PR01CA0009.jpnprd01.prod.outlook.com (25.161.74.147) To HKXPR06MB325.apcprd06.prod.outlook.com (10.141.133.15) Authentication-Results: intel.com; dkim=none (message not signed) header.d=none; X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:HKXPR06MB325; X-Microsoft-Antispam-PRVS: X-Forefront-Antispam-Report: BMV:1; SFV:NSPM; SFS:(10019020)(6069001)(6009001)(77156002)(46102003)(62966003)(36756003)(19580405001)(92566002)(19580395003)(78352002)(33646002)(47776003)(42382002)(76506005)(66066001)(40100003)(50226001)(87976001)(48376002)(122386002)(77096005)(50986999)(229853001)(42186005)(50466002); DIR:OUT; SFP:1102; SCL:1; SRVR:HKXPR06MB325; H:localhost; FPR:; SPF:None; MLV:sfv; LANG:en; X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(601004)(5005006)(5002010); SRVR:HKXPR06MB325; BCL:0; PCL:0; RULEID:; SRVR:HKXPR06MB325; X-Forefront-PRVS: 05352A48BE X-OriginatorOrg: renesas.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Apr 2015 11:20:23.3904 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HKXPR06MB325 Sender: dmaengine-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: dmaengine@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This patch fixes an issue that the usb_dmac_desc_free() is dereferencing freed memory 'desc' because it uses list_for_each_entry(). This function should use list_for_each_entry_safe(). Reported-by: Dan Carpenter Signed-off-by: Yoshihiro Shimoda --- This patch is based on slave-dma / for-linus branch. (commit id = f3070e7efdc37a84fa63cbe84ac4febc87440121) drivers/dma/sh/usb-dmac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c index d5dad98..f705798 100644 --- a/drivers/dma/sh/usb-dmac.c +++ b/drivers/dma/sh/usb-dmac.c @@ -285,13 +285,13 @@ static int usb_dmac_desc_alloc(struct usb_dmac_chan *chan, unsigned int sg_len, static void usb_dmac_desc_free(struct usb_dmac_chan *chan) { - struct usb_dmac_desc *desc; + struct usb_dmac_desc *desc, *_desc; LIST_HEAD(list); list_splice_init(&chan->desc_freed, &list); list_splice_init(&chan->desc_got, &list); - list_for_each_entry(desc, &list, node) { + list_for_each_entry_safe(desc, _desc, &list, node) { list_del(&desc->node); kfree(desc); }