diff options
| author | Thomas Pugliese <thomas.pugliese@gmail.com> | 2013-09-26 21:08:16 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-09-27 01:31:37 +0200 |
| commit | 6741448eb01a1844b78c83fa8faf0c95524fc09b (patch) | |
| tree | 93b1ab4c7a81045a47f49371354f55759e73ebb1 /drivers/usb/wusbcore | |
| parent | usb: wusbcore: clean up the sg list that was created for out transfers (diff) | |
| download | linux-6741448eb01a1844b78c83fa8faf0c95524fc09b.tar.xz linux-6741448eb01a1844b78c83fa8faf0c95524fc09b.zip | |
usb: wusbcore: set pointers to NULL after freeing in error cases
This patch fixes two cases where error handling code was freeing memory
but not setting the pointer to NULL. This could lead to a double free
in the HWA shutdown code.
Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/wusbcore')
| -rw-r--r-- | drivers/usb/wusbcore/wa-xfer.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c index 61b0597c399b..0b27146b5bc1 100644 --- a/drivers/usb/wusbcore/wa-xfer.c +++ b/drivers/usb/wusbcore/wa-xfer.c @@ -1560,6 +1560,7 @@ error_submit_buf_in: xfer, seg_idx, result); seg->result = result; kfree(wa->buf_in_urb->sg); + wa->buf_in_urb->sg = NULL; error_sg_alloc: __wa_xfer_abort(xfer); error_complete: @@ -1859,6 +1860,7 @@ out: error_dti_urb_submit: usb_put_urb(wa->buf_in_urb); + wa->buf_in_urb = NULL; error_buf_in_urb_alloc: usb_put_urb(wa->dti_urb); wa->dti_urb = NULL; |