Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-12 Thread Sarah Sharp
On Thu, Nov 01, 2012 at 01:28:46PM -0700, Julius Werner wrote: > >> Is it just > >> for (prev = *first; prev; prev = prev->next) > >>xhci_segment_free(xhci, prev); > >> > >> ? > > > > Yeah, that seems cleaner. > > > > Sarah Sharp > > I can submit it that way if you want, but I would advise

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-12 Thread Sarah Sharp
On Thu, Nov 01, 2012 at 01:28:46PM -0700, Julius Werner wrote: Is it just for (prev = *first; prev; prev = prev-next) xhci_segment_free(xhci, prev); ? Yeah, that seems cleaner. Sarah Sharp I can submit it that way if you want, but I would advise against it. This way

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Julius Werner
>> Is it just >> for (prev = *first; prev; prev = prev->next) >>xhci_segment_free(xhci, prev); >> >> ? > > Yeah, that seems cleaner. > > Sarah Sharp I can submit it that way if you want, but I would advise against it. This way you access the prev pointer after it has been freed already…

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Sarah Sharp
On Thu, Nov 01, 2012 at 10:13:00PM +0200, Andy Shevchenko wrote: > On Thu, Nov 1, 2012 at 9:47 PM, Julius Werner wrote: > > xhci_alloc_segments_for_ring() builds a list of xhci_segments and links > > the tail to head at the end (forming a ring). When it bails out for OOM > > reasons half-way

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Andy Shevchenko
On Thu, Nov 1, 2012 at 9:47 PM, Julius Werner wrote: > xhci_alloc_segments_for_ring() builds a list of xhci_segments and links > the tail to head at the end (forming a ring). When it bails out for OOM > reasons half-way through, it tries to destroy its half-built list with >

[PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Julius Werner
xhci_alloc_segments_for_ring() builds a list of xhci_segments and links the tail to head at the end (forming a ring). When it bails out for OOM reasons half-way through, it tries to destroy its half-built list with xhci_free_segments_for_ring(), even though it is not a ring yet. This causes a

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Sarah Sharp
On Mon, Oct 29, 2012 at 09:35:15PM +0300, Sergei Shtylyov wrote: > Hello. > > On 10/29/2012 08:00 PM, Julius Werner wrote: > > next = xhci_segment_alloc(xhci, cycle_state, flags); > > if (!next) { > > - xhci_free_segments_for_ring(xhci, *first); > > +

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Sarah Sharp
On Mon, Oct 29, 2012 at 09:35:15PM +0300, Sergei Shtylyov wrote: Hello. On 10/29/2012 08:00 PM, Julius Werner wrote: next = xhci_segment_alloc(xhci, cycle_state, flags); if (!next) { - xhci_free_segments_for_ring(xhci, *first); +

[PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Julius Werner
xhci_alloc_segments_for_ring() builds a list of xhci_segments and links the tail to head at the end (forming a ring). When it bails out for OOM reasons half-way through, it tries to destroy its half-built list with xhci_free_segments_for_ring(), even though it is not a ring yet. This causes a

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Andy Shevchenko
On Thu, Nov 1, 2012 at 9:47 PM, Julius Werner jwer...@chromium.org wrote: xhci_alloc_segments_for_ring() builds a list of xhci_segments and links the tail to head at the end (forming a ring). When it bails out for OOM reasons half-way through, it tries to destroy its half-built list with

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Sarah Sharp
On Thu, Nov 01, 2012 at 10:13:00PM +0200, Andy Shevchenko wrote: On Thu, Nov 1, 2012 at 9:47 PM, Julius Werner jwer...@chromium.org wrote: xhci_alloc_segments_for_ring() builds a list of xhci_segments and links the tail to head at the end (forming a ring). When it bails out for OOM reasons

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-11-01 Thread Julius Werner
Is it just for (prev = *first; prev; prev = prev-next) xhci_segment_free(xhci, prev); ? Yeah, that seems cleaner. Sarah Sharp I can submit it that way if you want, but I would advise against it. This way you access the prev pointer after it has been freed already… that's probably

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-10-29 Thread Julius Werner
>I have noticed that the patch description has DOS line endings as well. Sorry about those, Gmail adds them automatically. According to RFC 2046 (section 4.1.1), text/plain content must use CRLFs to encode line breaks, so I guess this is the right thing. Your MUA should be responsible for

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-10-29 Thread Sergei Shtylyov
Hello. On 10/29/2012 08:00 PM, Julius Werner wrote: > xhci_alloc_segments_for_ring() builds a list of xhci_segments and links > the tail to head at the end (forming a ring). When it bails out for OOM > reasons half-way through, it tries to destroy its half-built list with >

[PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-10-29 Thread Julius Werner
xhci_alloc_segments_for_ring() builds a list of xhci_segments and links the tail to head at the end (forming a ring). When it bails out for OOM reasons half-way through, it tries to destroy its half-built list with xhci_free_segments_for_ring(), even though it is not a ring yet. This causes a

[PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-10-29 Thread Julius Werner
xhci_alloc_segments_for_ring() builds a list of xhci_segments and links the tail to head at the end (forming a ring). When it bails out for OOM reasons half-way through, it tries to destroy its half-built list with xhci_free_segments_for_ring(), even though it is not a ring yet. This causes a

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-10-29 Thread Sergei Shtylyov
Hello. On 10/29/2012 08:00 PM, Julius Werner wrote: xhci_alloc_segments_for_ring() builds a list of xhci_segments and links the tail to head at the end (forming a ring). When it bails out for OOM reasons half-way through, it tries to destroy its half-built list with

Re: [PATCH] xhci: fix null-pointer dereference when destroying half-built segment rings

2012-10-29 Thread Julius Werner
I have noticed that the patch description has DOS line endings as well. Sorry about those, Gmail adds them automatically. According to RFC 2046 (section 4.1.1), text/plain content must use CRLFs to encode line breaks, so I guess this is the right thing. Your MUA should be responsible for