Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d0308d4b authored by Krzysztof Mazur's avatar Krzysztof Mazur Committed by Greg Kroah-Hartman
Browse files

usb: fix cleanup after failure in hub_configure() 



If the hub_configure() fails after setting the hdev->maxchild
the hub->ports might be NULL or point to uninitialized kzallocated
memory causing NULL pointer dereference in hub_quiesce() during cleanup.

Now after such error the hdev->maxchild is set to 0 to avoid cleanup
of uninitialized ports.

Signed-off-by: default avatarKrzysztof Mazur <krzysiek@podlesie.net>
Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f375fc52

drivers/usb/core/hub.c

+1 −0
Original line number Diff line number Diff line
@@ -1573,6 +1573,7 @@ static int hub_configure(struct usb_hub *hub, 
	return 0;



fail:

	hdev->maxchild = 0;

	dev_err (hub_dev, "config failed, %s (err %d)\n",

			message, ret);

	/* hub_disconnect() frees urb and descriptor */