aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorThomas Pugliese <thomas.pugliese@gmail.com>2013-09-26 14:08:16 -0500
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-09-26 16:31:37 -0700
commit6741448eb01a1844b78c83fa8faf0c95524fc09b (patch)
tree93b1ab4c7a81045a47f49371354f55759e73ebb1
parentd5b5c9f228bf15d134b0ac8d493b119417f5f9e9 (diff)
usb: wusbcore: set pointers to NULL after freeing in error cases
This patch fixes two cases where error handling code was freeing memory but not setting the pointer to NULL. This could lead to a double free in the HWA shutdown code. Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/usb/wusbcore/wa-xfer.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 61b0597c399b..0b27146b5bc1 100644
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -1560,6 +1560,7 @@ error_submit_buf_in:
xfer, seg_idx, result);
seg->result = result;
kfree(wa->buf_in_urb->sg);
+ wa->buf_in_urb->sg = NULL;
error_sg_alloc:
__wa_xfer_abort(xfer);
error_complete:
@@ -1859,6 +1860,7 @@ out:
error_dti_urb_submit:
usb_put_urb(wa->buf_in_urb);
+ wa->buf_in_urb = NULL;
error_buf_in_urb_alloc:
usb_put_urb(wa->dti_urb);
wa->dti_urb = NULL;

Privacy Policy