Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fbd1cd20 authored by Paul Zimmerman's avatar Paul Zimmerman Committed by Greg Kroah-Hartman
Browse files

staging: dwc2: fix potential use after free 



dwc2_process_non_isoc_desc() can potentially free the qtd, so null
out the qtd pointer if the call fails so we don't try to access it
later

Signed-off-by: default avatarPaul Zimmerman <paulz@synopsys.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9bda1aac

drivers/staging/dwc2/hcd_ddma.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -1103,8 +1103,10 @@ static void dwc2_complete_non_isoc_xfer_ddma(struct dwc2_hsotg *hsotg, 
		for (i = 0; i < qtd->n_desc; i++) {

		for (i = 0; i < qtd->n_desc; i++) {

			if (dwc2_process_non_isoc_desc(hsotg, chan, chnum, qtd,

			if (dwc2_process_non_isoc_desc(hsotg, chan, chnum, qtd,

						       desc_num, halt_status,

						       desc_num, halt_status,

						       &xfer_done))

						       &xfer_done)) {

				qtd = NULL;

				break;

				break;

			}

			desc_num++;

			desc_num++;

		}

		}

	}

	}