On Thu, Nov 29, 2018 at 10:29:31PM +0000, Malcolm Priestley wrote:
> The interrupt urb is killed but never freed add the function
>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Malcolm Priestley <tvboxspy@xxxxxxxxx>
> ---
> drivers/media/usb/dvb-usb-v2/lmedm04.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
> index f109c04f05ae..8b405e131439 100644
> --- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
> +++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
> @@ -1264,6 +1264,7 @@ static void *lme2510_exit_int(struct dvb_usb_device *d)
>
> if (st->lme_urb != NULL) {
> usb_kill_urb(st->lme_urb);
> + usb_free_urb(st->lme_urb);
Now st->lme_urb is a stale pointer.
> usb_free_coherent(d->udev, 128, st->buffer,
> st->lme_urb->transfer_dma);
And now you're following it.
> info("Interrupt Service Stopped");
> --
> 2.19.1
