Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit df3e1ab7 authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman
Browse files

USB: fix double kfree in ipaq in error case 



in the error case the ipaq driver leaves a dangling pointer to already
freed memory that will be freed again.

Signed-off-by: default avatarOliver Neukum <oneukum@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 35758589

drivers/usb/serial/ipaq.c

+2 −1
Original line number Diff line number Diff line
@@ -646,12 +646,13 @@ static int ipaq_open(struct usb_serial_port *port, struct file *filp) 
	 */



	kfree(port->bulk_in_buffer);

	kfree(port->bulk_out_buffer);

	port->bulk_in_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL);

	if (port->bulk_in_buffer == NULL) {

		port->bulk_out_buffer = NULL; /* prevent double free */

		goto enomem;

	}



	kfree(port->bulk_out_buffer);

	port->bulk_out_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL);

	if (port->bulk_out_buffer == NULL) {

		kfree(port->bulk_in_buffer);