diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2013-07-22 09:57:49 +0300 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-07-23 15:08:50 -0700 |
| commit | c8145c56103099565be2e18aeac2a32f79361f3f (patch) | |
| tree | 1e0e82ae7051a0a54e240b5944c0107fa3ace920 /drivers/staging | |
| parent | staging: comedi: fix a race between do_cmd_ioctl() and read/write (diff) | |
| download | linux-dev-c8145c56103099565be2e18aeac2a32f79361f3f.tar.xz linux-dev-c8145c56103099565be2e18aeac2a32f79361f3f.zip | |
staging: frontier: use after free in disconnect()
usb_alphatrack_delete() frees "dev" so we can't use it on that path.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/frontier/alphatrack.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/frontier/alphatrack.c b/drivers/staging/frontier/alphatrack.c index 5590ebf1da15..817f837b240d 100644 --- a/drivers/staging/frontier/alphatrack.c +++ b/drivers/staging/frontier/alphatrack.c @@ -827,11 +827,11 @@ static void usb_alphatrack_disconnect(struct usb_interface *intf) mutex_unlock(&dev->mtx); usb_alphatrack_delete(dev); } else { + atomic_set(&dev->writes_pending, 0); dev->intf = NULL; mutex_unlock(&dev->mtx); } - atomic_set(&dev->writes_pending, 0); mutex_unlock(&disconnect_mutex); dev_info(&intf->dev, "Alphatrack Surface #%d now disconnected\n", |