Commit fbd1cd20 authored by Paul Zimmerman's avatar Paul Zimmerman Committed by Greg Kroah-Hartman

staging: dwc2: fix potential use after free

dwc2_process_non_isoc_desc() can potentially free the qtd, so null
out the qtd pointer if the call fails so we don't try to access it
later
Signed-off-by: default avatarPaul Zimmerman <paulz@synopsys.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9bda1aac
...@@ -1103,8 +1103,10 @@ static void dwc2_complete_non_isoc_xfer_ddma(struct dwc2_hsotg *hsotg, ...@@ -1103,8 +1103,10 @@ static void dwc2_complete_non_isoc_xfer_ddma(struct dwc2_hsotg *hsotg,
for (i = 0; i < qtd->n_desc; i++) { for (i = 0; i < qtd->n_desc; i++) {
if (dwc2_process_non_isoc_desc(hsotg, chan, chnum, qtd, if (dwc2_process_non_isoc_desc(hsotg, chan, chnum, qtd,
desc_num, halt_status, desc_num, halt_status,
&xfer_done)) &xfer_done)) {
qtd = NULL;
break; break;
}
desc_num++; desc_num++;
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment