Hi Guys:
I met a bug in drivers/net/usb/hso.c used in my tablet. Here is the patch.
============================================================
From: Wang Zhi <zhi.wang@xxxxxxxxxxxxx>
Date: Thu, 14 Jul 2011 15:01:51 +0800
Subject: [PATCH]: USB: NET: Fix invalid memory free on the USB
disconnetion path in HSO Driver (drivers/net/usb/hso.c)
This issue is located at hso_free_net_device(). Pointers named hso_net
and hso_net->net point to a memory block which is allocated by
alloc_etherdev(). So when free_netdev() get called, hso_net and
hso_net->net is invalid.
Signed-off-by: Wang Zhi <zhi.wang@xxxxxxxxxxxxx>
---
hso.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 387ca43..304fe78 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2421,10 +2421,8 @@ static void hso_free_net_device(struct
hso_device *hso_dev)
remove_net_device(hso_net->parent);
- if (hso_net->net) {
+ if (hso_net->net)
unregister_netdev(hso_net->net);
- free_netdev(hso_net->net);
- }
/* start freeing */
for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {
@@ -2436,6 +2434,9 @@ static void hso_free_net_device(struct
hso_device *hso_dev)
kfree(hso_net->mux_bulk_tx_buf);
hso_net->mux_bulk_tx_buf = NULL;
+ if (hso_net->net)
+ free_netdev(hso_net->net);
+
kfree(hso_dev);
}
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
