Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c8145c56 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: frontier: use after free in disconnect() 



usb_alphatrack_delete() frees "dev" so we can't use it on that path.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4b18f08b

drivers/staging/frontier/alphatrack.c

+1 −1
Original line number Diff line number Diff line
@@ -827,11 +827,11 @@ static void usb_alphatrack_disconnect(struct usb_interface *intf) 
		mutex_unlock(&dev->mtx);

		usb_alphatrack_delete(dev);

	} else {

		atomic_set(&dev->writes_pending, 0);

		dev->intf = NULL;

		mutex_unlock(&dev->mtx);

	}



	atomic_set(&dev->writes_pending, 0);

	mutex_unlock(&disconnect_mutex);



	dev_info(&intf->dev, "Alphatrack Surface #%d now disconnected\n",