This patch fixes two cases where error handling code was freeing memory but not setting the pointer to NULL. This could lead to a double free in the HWA shutdown code. Signed-off-by: Thomas Pugliese <thomas.pugliese@xxxxxxxxx> --- drivers/usb/wusbcore/wa-xfer.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c index 78b7ae0..08bf21d 100644 --- a/drivers/usb/wusbcore/wa-xfer.c +++ b/drivers/usb/wusbcore/wa-xfer.c @@ -1560,6 +1560,7 @@ error_submit_buf_in: xfer, seg_idx, result); seg->result = result; kfree(wa->buf_in_urb->sg); + wa->buf_in_urb->sg = NULL; error_sg_alloc: __wa_xfer_abort(xfer); error_complete: @@ -1861,6 +1862,7 @@ out: error_dti_urb_submit: usb_put_urb(wa->buf_in_urb); + wa->buf_in_urb = NULL; error_buf_in_urb_alloc: usb_put_urb(wa->dti_urb); wa->dti_urb = NULL; -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
