diff options
| author | Patrick Georgi <patrick@georgi-clan.de> | 2015-02-22 16:49:10 +0100 |
|---|---|---|
| committer | Patrick Georgi <pgeorgi@google.com> | 2015-02-23 20:33:54 +0100 |
| commit | a6c7ae70140450205cda6226e1905dfecb6cfabf (patch) | |
| tree | 9f4e0dcb7ad1dd8a2963bbae64306854785935b5 /payloads/libpayload/drivers/usb/ohci.c | |
| parent | 477b4c539a5c05a0ccdf11b68fdff78b2ebe56cb (diff) | |
libpayload: avoid use-after-free in OHCI driver
Change-Id: I89294c22c57564262e53e36c5ae9ac6eb0ed934a
Signed-off-by: Patrick Georgi <patrick@georgi-clan.de>
Found-by: Coverity Scan
Reviewed-on: http://review.coreboot.org/8510
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Reviewed-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Tested-by: build bot (Jenkins)
Diffstat (limited to 'payloads/libpayload/drivers/usb/ohci.c')
| -rw-r--r-- | payloads/libpayload/drivers/usb/ohci.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/payloads/libpayload/drivers/usb/ohci.c b/payloads/libpayload/drivers/usb/ohci.c index 3aa7810bd9..dffb8a49cd 100644 --- a/payloads/libpayload/drivers/usb/ohci.c +++ b/payloads/libpayload/drivers/usb/ohci.c @@ -854,12 +854,12 @@ ohci_process_done_queue(ohci_t *const ohci, const int spew_debug) /* Free this TD, and */ free(td); --intrq->remaining_tds; - /* the interrupt queue if it has no more TDs. */ - if (!intrq->remaining_tds) - free(intrq); usb_debug("Freed TD from orphaned interrupt " "queue, %d TDs remain.\n", intrq->remaining_tds); + /* the interrupt queue if it has no more TDs. */ + if (!intrq->remaining_tds) + free(intrq); } else { /* Save done TD to be processed. */ td->next = temp_tdq; |