aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/staging/frontier
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2013-07-22 09:57:49 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-07-23 15:08:50 -0700
commitc8145c56103099565be2e18aeac2a32f79361f3f (patch)
tree1e0e82ae7051a0a54e240b5944c0107fa3ace920 /drivers/staging/frontier
parent4b18f08be01a7b3c7b6df497137b6e3cb28adaa3 (diff)
staging: frontier: use after free in disconnect()
usb_alphatrack_delete() frees "dev" so we can't use it on that path. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/frontier')
-rw-r--r--drivers/staging/frontier/alphatrack.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/frontier/alphatrack.c b/drivers/staging/frontier/alphatrack.c
index 5590ebf1da15..817f837b240d 100644
--- a/drivers/staging/frontier/alphatrack.c
+++ b/drivers/staging/frontier/alphatrack.c
@@ -827,11 +827,11 @@ static void usb_alphatrack_disconnect(struct usb_interface *intf)
mutex_unlock(&dev->mtx);
usb_alphatrack_delete(dev);
} else {
+ atomic_set(&dev->writes_pending, 0);
dev->intf = NULL;
mutex_unlock(&dev->mtx);
}
- atomic_set(&dev->writes_pending, 0);
mutex_unlock(&disconnect_mutex);
dev_info(&intf->dev, "Alphatrack Surface #%d now disconnected\n",

Privacy Policy