diff options
| author |   Dan Carpenter <error27@gmail.com> | 2010-03-25 13:14:27 +0200 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@suse.de> | 2010-04-30 09:25:08 -0700 |
| commit | 714bc5ef3edaec3ca0cf155fe01411760527c52e (patch) | |
| tree | 0983d463571594d1e834fc89cff594d23c45f91c /drivers/usb | |
| parent | musb: save and restore missing bus control register (diff) | |
| download | linux-dev-714bc5ef3edaec3ca0cf155fe01411760527c52e.tar.xz linux-dev-714bc5ef3edaec3ca0cf155fe01411760527c52e.zip | |
musb: potential use after free
We assign "urb->hcpriv = qh;" a few lines down. I'm pretty sure we
want it "urb->hcpriv" to be NULL not a freed value.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/musb/musb_host.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c index dec896e888db..877d20b1dff9 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -2042,6 +2042,7 @@ static int musb_urb_enqueue( * odd, rare, error prone, but legal. */ kfree(qh); + qh = NULL; ret = 0; } else ret = musb_schedule(musb, qh, |