From a6c7ae70140450205cda6226e1905dfecb6cfabf Mon Sep 17 00:00:00 2001 From: Patrick Georgi Date: Sun, 22 Feb 2015 16:49:10 +0100 Subject: libpayload: avoid use-after-free in OHCI driver Change-Id: I89294c22c57564262e53e36c5ae9ac6eb0ed934a Signed-off-by: Patrick Georgi Found-by: Coverity Scan Reviewed-on: http://review.coreboot.org/8510 Reviewed-by: Paul Menzel Reviewed-by: Alexandru Gagniuc Tested-by: build bot (Jenkins) --- payloads/libpayload/drivers/usb/ohci.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'payloads') diff --git a/payloads/libpayload/drivers/usb/ohci.c b/payloads/libpayload/drivers/usb/ohci.c index 3aa7810bd9..dffb8a49cd 100644 --- a/payloads/libpayload/drivers/usb/ohci.c +++ b/payloads/libpayload/drivers/usb/ohci.c @@ -854,12 +854,12 @@ ohci_process_done_queue(ohci_t *const ohci, const int spew_debug) /* Free this TD, and */ free(td); --intrq->remaining_tds; - /* the interrupt queue if it has no more TDs. */ - if (!intrq->remaining_tds) - free(intrq); usb_debug("Freed TD from orphaned interrupt " "queue, %d TDs remain.\n", intrq->remaining_tds); + /* the interrupt queue if it has no more TDs. */ + if (!intrq->remaining_tds) + free(intrq); } else { /* Save done TD to be processed. */ td->next = temp_tdq; -- cgit v1.2.3