GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libpayload: fix use-after-free in usb_exit() 

The controller's shutdown function free()s the controller structure so
we shouldn't access it any more after calling shutdown.

As all controllers detach themself, i.e. unchain themself from usb_hcs,
just keep iterating over usb_hcs until it's NULL.

Change-Id: Ie85caba0f685494c3fe04c550a5a14bc4158a94e
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Reviewed-on: http://review.coreboot.org/2900
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Tested-by: build bot (Jenkins)
Reviewed-by: Anton Kochkov <anton.kochkov@gmail.com>
This commit is contained in:
Mathias Krause 2013-03-24 19:40:02 +01:00 committed by Anton Kochkov
parent 7a9da71c5f
commit 59c020ab15
1 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
payloads/libpayload/drivers/usb/usb.c
View File

@ -74,12 +74,8 @@ detach_controller (hci_t *controller)
int
usb_exit (void)
{
if (usb_hcs == 0)
return 0;
hci_t *controller = usb_hcs;
while (controller != NULL) {
controller->shutdown(controller);
controller = controller->next;
while (usb_hcs != NULL) {
usb_hcs->shutdown(usb_hcs);
}
return 0;
}