summaryrefslogtreecommitdiff
path: root/drivers/dma/sh
diff options
context:
space:
mode:
authorYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>2015-04-03 20:20:15 +0900
committerVinod Koul <vinod.koul@intel.com>2015-04-17 23:28:48 +0530
commitd7d8e892aa6fe280a2e2974d9fd1ec9253ee1a05 (patch)
tree332e18f29948518da896e908c98d781b7b5b734d /drivers/dma/sh
parent28591dfdd96c6289aebbf12d8eb4e5dc5ddbde97 (diff)
dmaengine: usb-dmac: Fix dereferencing freed memory 'desc'
This patch fixes an issue that the usb_dmac_desc_free() is dereferencing freed memory 'desc' because it uses list_for_each_entry(). This function should use list_for_each_entry_safe(). Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Diffstat (limited to 'drivers/dma/sh')
-rw-r--r--drivers/dma/sh/usb-dmac.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index d5dad98bef0b..f705798ce3eb 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -285,13 +285,13 @@ static int usb_dmac_desc_alloc(struct usb_dmac_chan *chan, unsigned int sg_len,
static void usb_dmac_desc_free(struct usb_dmac_chan *chan)
{
- struct usb_dmac_desc *desc;
+ struct usb_dmac_desc *desc, *_desc;
LIST_HEAD(list);
list_splice_init(&chan->desc_freed, &list);
list_splice_init(&chan->desc_got, &list);
- list_for_each_entry(desc, &list, node) {
+ list_for_each_entry_safe(desc, _desc, &list, node) {
list_del(&desc->node);
kfree(desc);
}