Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6741448e authored by Thomas Pugliese's avatar Thomas Pugliese Committed by Greg Kroah-Hartman
Browse files

usb: wusbcore: set pointers to NULL after freeing in error cases 



This patch fixes two cases where error handling code was freeing memory
but not setting the pointer to NULL.  This could lead to a double free
in the HWA shutdown code.

Signed-off-by: default avatarThomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d5b5c9f2

drivers/usb/wusbcore/wa-xfer.c

+2 −0
Original line number Diff line number Diff line
@@ -1560,6 +1560,7 @@ static void wa_xfer_result_chew(struct wahc *wa, struct wa_xfer *xfer, 
			xfer, seg_idx, result);

	seg->result = result;

	kfree(wa->buf_in_urb->sg);

	wa->buf_in_urb->sg = NULL;

error_sg_alloc:

	__wa_xfer_abort(xfer);

error_complete:
@@ -1859,6 +1860,7 @@ void wa_handle_notif_xfer(struct wahc *wa, struct wa_notif_hdr *notif_hdr) 


error_dti_urb_submit:

	usb_put_urb(wa->buf_in_urb);

	wa->buf_in_urb = NULL;

error_buf_in_urb_alloc:

	usb_put_urb(wa->dti_urb);

	wa->dti_urb = NULL;