From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
Date: Sat, 23 Nov 2013 00:43:46 +0000 (-0800)
Subject: staging: dwc2: fix potential use after free
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=fbd1cd202739558210fd8f441b36601b29050bf4;p=linux-beck.git

staging: dwc2: fix potential use after free

dwc2_process_non_isoc_desc() can potentially free the qtd, so null
out the qtd pointer if the call fails so we don't try to access it
later

Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/staging/dwc2/hcd_ddma.c b/drivers/staging/dwc2/hcd_ddma.c
index c7d434519776..72e9788c1a13 100644
--- a/drivers/staging/dwc2/hcd_ddma.c
+++ b/drivers/staging/dwc2/hcd_ddma.c
@@ -1103,8 +1103,10 @@ static void dwc2_complete_non_isoc_xfer_ddma(struct dwc2_hsotg *hsotg,
 		for (i = 0; i < qtd->n_desc; i++) {
 			if (dwc2_process_non_isoc_desc(hsotg, chan, chnum, qtd,
 						       desc_num, halt_status,
-						       &xfer_done))
+						       &xfer_done)) {
+				qtd = NULL;
 				break;
+			}
 			desc_num++;
 		}
 	}