diff options
| author | Lorenz Meier <lm@inf.ethz.ch> | 2015-01-19 20:14:26 +0100 |
|---|---|---|
| committer | Lorenz Meier <lm@inf.ethz.ch> | 2015-01-19 20:14:26 +0100 |
| commit | 574bac488f384ddaa344378e25653c27124a2b69 (patch) | |
| tree | 261f0739cd70ef18ee9353063a3384a9732e5d1f | |
| parent | dbcccb2455d759b789d549d25e1fbf489b2d3c83 (diff) | |
| download | nuttx-574bac488f384ddaa344378e25653c27124a2b69.tar.gz nuttx-574bac488f384ddaa344378e25653c27124a2b69.tar.bz2 nuttx-574bac488f384ddaa344378e25653c27124a2b69.zip | |
Critical hotfixes for memory accesses. Found via Coverity by Pavel Kirienko
| -rw-r--r-- | nuttx/drivers/pipes/pipe.c | 5 | ||||
| -rw-r--r-- | nuttx/drivers/usbdev/cdcacm.c | 8 | ||||
| -rw-r--r-- | nuttx/mm/mm_granalloc.c | 3 |
3 files changed, 10 insertions, 6 deletions
diff --git a/nuttx/drivers/pipes/pipe.c b/nuttx/drivers/pipes/pipe.c index 20c160475..86cdeba84 100644 --- a/nuttx/drivers/pipes/pipe.c +++ b/nuttx/drivers/pipes/pipe.c @@ -275,7 +275,10 @@ errout_with_wrfd: errout_with_driver: unregister_driver(devname); errout_with_dev: - pipecommon_freedev(dev); + if (dev) + { + pipecommon_freedev(dev); + } errout_with_pipe: pipe_free(pipeno); errout: diff --git a/nuttx/drivers/usbdev/cdcacm.c b/nuttx/drivers/usbdev/cdcacm.c index 2584ce428..d3ddb8e4d 100644 --- a/nuttx/drivers/usbdev/cdcacm.c +++ b/nuttx/drivers/usbdev/cdcacm.c @@ -1181,12 +1181,12 @@ static void cdcacm_unbind(FAR struct usbdevclass_driver_s *driver, } DEBUGASSERT(priv->nwrq == 0); irqrestore(flags); - } - /* Clear out all data in the circular buffer */ + /* Clear out all data in the circular buffer */ - priv->serdev.xmit.head = 0; - priv->serdev.xmit.tail = 0; + priv->serdev.xmit.head = 0; + priv->serdev.xmit.tail = 0; + } } /**************************************************************************** diff --git a/nuttx/mm/mm_granalloc.c b/nuttx/mm/mm_granalloc.c index e95709b31..df6bde805 100644 --- a/nuttx/mm/mm_granalloc.c +++ b/nuttx/mm/mm_granalloc.c @@ -313,9 +313,10 @@ static inline FAR void *gran_common_alloc(FAR struct gran_s *priv, size_t size) bitidx += shift; } } + + gran_leave_critical(priv); } - gran_leave_critical(priv); return NULL; } |