GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libpayload: usb: don't prematurely free the usb device 

Before the controller's destroy_device() could interrogate
the usbdev_t object usb_detach_device() was freeing and
NULLing out the pointer. That results in all callers who
needed that object to start accessing random bits of memory.

This eventually led into free()ing memory it shouldn't which
corrupted the allocator's state. Eventually, all forward
progress was lost by way of a single ended linked list
turning into a circular list.

The culprit seems to be a bad merge in commit e00ba21.

BUG=chrome-os-partner:43419
BRANCH=None
TEST=Can boot into OS now w/o "hanging" on glados.

Original-Change-Id: I86dcaa1dbaf112ac6782e90dad40f0932f273a1f
Original-Signed-off-by: Aaron Durbin <adurbin@chromium.org>
Original-Reviewed-on: https://chromium-review.googlesource.com/290048
Original-Reviewed-by: Julius Werner <jwerner@chromium.org>

Change-Id: I9135eb0f798bf7dbeccc7a033c3f8471720a0de5
Signed-off-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-on: http://review.coreboot.org/11173
Tested-by: build bot (Jenkins)
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
This commit is contained in:
Aaron Durbin 2015-07-31 17:08:00 -05:00
parent e33a1724b3
commit e3260ec29a
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
payloads/libpayload/drivers/usb/usb.c
View File

@ -605,10 +605,12 @@ usb_detach_device(hci_t *controller, int devno)
been called yet by the usb class driver */ been called yet by the usb class driver */
if (controller->devices[devno]) { if (controller->devices[devno]) {
controller->devices[devno]->destroy (controller->devices[devno]); controller->devices[devno]->destroy (controller->devices[devno]);
free(controller->devices[devno]);
controller->devices[devno] = NULL;
if (controller->destroy_device) if (controller->destroy_device)
controller->destroy_device(controller, devno); controller->destroy_device(controller, devno);
/* Tear down the device itself *after* destroy_device()
* has had a chance to interoogate it. */
free(controller->devices[devno]);
controller->devices[devno] = NULL;
} }
} }