diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-03-25 07:14:27 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-04-30 12:25:08 -0400 |
| commit | 714bc5ef3edaec3ca0cf155fe01411760527c52e (patch) | |
| tree | 0983d463571594d1e834fc89cff594d23c45f91c /drivers/usb/musb/musb_host.c | |
| parent | 5e0e61afa5b342c0197fce2d4fd2a2b515e96b31 (diff) | |
musb: potential use after free
We assign "urb->hcpriv = qh;" a few lines down. I'm pretty sure we
want it "urb->hcpriv" to be NULL not a freed value.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/musb/musb_host.c')
| -rw-r--r-- | drivers/usb/musb/musb_host.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c index dec896e888db..877d20b1dff9 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c | |||
| @@ -2042,6 +2042,7 @@ static int musb_urb_enqueue( | |||
| 2042 | * odd, rare, error prone, but legal. | 2042 | * odd, rare, error prone, but legal. |
| 2043 | */ | 2043 | */ |
| 2044 | kfree(qh); | 2044 | kfree(qh); |
| 2045 | qh = NULL; | ||
| 2045 | ret = 0; | 2046 | ret = 0; |
| 2046 | } else | 2047 | } else |
| 2047 | ret = musb_schedule(musb, qh, | 2048 | ret = musb_schedule(musb, qh, |