Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-12 Thread Sarah Sharp
On Thu, Nov 01, 2012 at 01:28:46PM -0700, Julius Werner wrote: > >> Is it just > >> for (prev = *first; prev; prev = prev->next) > >>xhci_segment_free(xhci, prev); > >> > >> ? > > > > Yeah, that seems cleaner. > > > > Sarah Sharp > > I can submit it that way if you want, but I would advise

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Julius Werner
>> Is it just >> for (prev = *first; prev; prev = prev->next) >>xhci_segment_free(xhci, prev); >> >> ? > > Yeah, that seems cleaner. > > Sarah Sharp I can submit it that way if you want, but I would advise against it. This way you access the prev pointer after it has been freed already… th

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Sarah Sharp
On Thu, Nov 01, 2012 at 10:13:00PM +0200, Andy Shevchenko wrote: > On Thu, Nov 1, 2012 at 9:47 PM, Julius Werner wrote: > > xhci_alloc_segments_for_ring() builds a list of xhci_segments and links > > the tail to head at the end (forming a ring). When it bails out for OOM > > reasons half-way throu

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Andy Shevchenko
On Thu, Nov 1, 2012 at 9:47 PM, Julius Werner wrote: > xhci_alloc_segments_for_ring() builds a list of xhci_segments and links > the tail to head at the end (forming a ring). When it bails out for OOM > reasons half-way through, it tries to destroy its half-built list with > xhci_free_segments_for

[PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Julius Werner
xhci_alloc_segments_for_ring() builds a list of xhci_segments and links the tail to head at the end (forming a ring). When it bails out for OOM reasons half-way through, it tries to destroy its half-built list with xhci_free_segments_for_ring(), even though it is not a ring yet. This causes a null-

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Sarah Sharp
On Mon, Oct 29, 2012 at 09:35:15PM +0300, Sergei Shtylyov wrote: > Hello. > > On 10/29/2012 08:00 PM, Julius Werner wrote: > > next = xhci_segment_alloc(xhci, cycle_state, flags); > > if (!next) { > > - xhci_free_segments_for_ring(xhci, *first); > > +

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-10-29 Thread Julius Werner
>I have noticed that the patch description has DOS line endings as well. Sorry about those, Gmail adds them automatically. According to RFC 2046 (section 4.1.1), text/plain content must use CRLFs to encode line breaks, so I guess this is the right thing. Your MUA should be responsible for conv

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-10-29 Thread Sergei Shtylyov
Hello. On 10/29/2012 08:00 PM, Julius Werner wrote: > xhci_alloc_segments_for_ring() builds a list of xhci_segments and links > the tail to head at the end (forming a ring). When it bails out for OOM > reasons half-way through, it tries to destroy its half-built list with > xhci_free_segments_for

[PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-10-29 Thread Julius Werner
xhci_alloc_segments_for_ring() builds a list of xhci_segments and links the tail to head at the end (forming a ring). When it bails out for OOM reasons half-way through, it tries to destroy its half-built list with xhci_free_segments_for_ring(), even though it is not a ring yet. This causes a null-