Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ed6590a8 authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman
Browse files

USB: fix double frees in error code paths of ipaq driver 



the error code paths can be enter with buffers to freed buffers.
Serial core would do a kfree() on memory already freed.

Signed-off-by: default avatarOliver Neukum <oneukum@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 0e66fb34

drivers/usb/serial/ipaq.c

+2 −0
Original line number Diff line number Diff line
@@ -646,11 +646,13 @@ static int ipaq_open(struct usb_serial_port *port, struct file *filp) 
	kfree(port->bulk_out_buffer);

	port->bulk_in_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL);

	if (port->bulk_in_buffer == NULL) {

		port->bulk_out_buffer = NULL; /* prevent double free */

		goto enomem;

	}

	port->bulk_out_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL);

	if (port->bulk_out_buffer == NULL) {

		kfree(port->bulk_in_buffer);

		port->bulk_in_buffer = NULL;

		goto enomem;

	}

	port->read_urb->transfer_buffer = port->bulk_in_buffer;