diff options
author | Oliver Neukum <oliver@neukum.org> | 2008-06-30 08:33:57 -0400 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2008-07-21 18:16:47 -0400 |
commit | df3e1ab7334279bc744344bcf05272dc8b985d3d (patch) | |
tree | c76e39449db8e86780442a1ae7f81d969f79c2fe /drivers/usb/serial/ipaq.c | |
parent | 357585892e56f7c7bec4a9c8dfaf90257c8756c6 (diff) |
USB: fix double kfree in ipaq in error case
in the error case the ipaq driver leaves a dangling pointer to already
freed memory that will be freed again.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/serial/ipaq.c')
-rw-r--r-- | drivers/usb/serial/ipaq.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c index d9fb3768a2d7..80d9ec5570d6 100644 --- a/drivers/usb/serial/ipaq.c +++ b/drivers/usb/serial/ipaq.c | |||
@@ -646,12 +646,13 @@ static int ipaq_open(struct usb_serial_port *port, struct file *filp) | |||
646 | */ | 646 | */ |
647 | 647 | ||
648 | kfree(port->bulk_in_buffer); | 648 | kfree(port->bulk_in_buffer); |
649 | kfree(port->bulk_out_buffer); | ||
650 | port->bulk_in_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL); | 649 | port->bulk_in_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL); |
651 | if (port->bulk_in_buffer == NULL) { | 650 | if (port->bulk_in_buffer == NULL) { |
652 | port->bulk_out_buffer = NULL; /* prevent double free */ | 651 | port->bulk_out_buffer = NULL; /* prevent double free */ |
653 | goto enomem; | 652 | goto enomem; |
654 | } | 653 | } |
654 | |||
655 | kfree(port->bulk_out_buffer); | ||
655 | port->bulk_out_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL); | 656 | port->bulk_out_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL); |
656 | if (port->bulk_out_buffer == NULL) { | 657 | if (port->bulk_out_buffer == NULL) { |
657 | kfree(port->bulk_in_buffer); | 658 | kfree(port->bulk_in_buffer); |