diff options
| author |   Oliver Neukum <oliver@neukum.org> | 2008-06-30 14:33:57 +0200 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@suse.de> | 2008-07-21 15:16:47 -0700 |
| commit | df3e1ab7334279bc744344bcf05272dc8b985d3d (patch) | |
| tree | c76e39449db8e86780442a1ae7f81d969f79c2fe | |
| parent | USB: fix build error in cdc-acm for CONFIG_PM=n (diff) | |
| download | linux-dev-df3e1ab7334279bc744344bcf05272dc8b985d3d.tar.xz linux-dev-df3e1ab7334279bc744344bcf05272dc8b985d3d.zip | |
USB: fix double kfree in ipaq in error case
in the error case the ipaq driver leaves a dangling pointer to already
freed memory that will be freed again.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/usb/serial/ipaq.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c index d9fb3768a2d7..80d9ec5570d6 100644 --- a/drivers/usb/serial/ipaq.c +++ b/drivers/usb/serial/ipaq.c @@ -646,12 +646,13 @@ static int ipaq_open(struct usb_serial_port *port, struct file *filp) */ kfree(port->bulk_in_buffer); - kfree(port->bulk_out_buffer); port->bulk_in_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL); if (port->bulk_in_buffer == NULL) { port->bulk_out_buffer = NULL; /* prevent double free */ goto enomem; } + + kfree(port->bulk_out_buffer); port->bulk_out_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL); if (port->bulk_out_buffer == NULL) { kfree(port->bulk_in_buffer); |