diff options
| author | Sarah Sharp <sarah.a.sharp@linux.intel.com> | 2010-05-01 02:37:56 +0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-05-21 00:21:40 +0400 |
| commit | 8a007748fbadb8317d0af289f3bca5694354d63a (patch) | |
| tree | bfeefd0403ea4f810d35a9c1ad087561c2a19c83 | |
| parent | 85bcb5ee889e0ebb9154718939e049de265fcdfb (diff) | |
| download | linux-8a007748fbadb8317d0af289f3bca5694354d63a.tar.xz | |
USB: xhci: Avoid double free after streams are disabled.
When a device is disconnected, xhci_free_virt_device() is called. Ramya
found that if the device had streams enabled, and then the driver freed
the streams with a call to usb_free_streams(), then about a minute after
he had called this, his machine crashed with a Bad DMA error. It turns
out that xhci_free_virt_device() would attempt to free the endpoint's
stream_info data structure if it wasn't NULL, and the free streams
function was not setting it to NULL after freeing it.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Tested-by: Ramya Desai <ramya.desai@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/usb/host/xhci.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 59f38a5f2fe6..a9b836d4b290 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -1746,6 +1746,7 @@ cleanup: for (i = 0; i < num_eps; i++) { ep_index = xhci_get_endpoint_index(&eps[i]->desc); xhci_free_stream_info(xhci, vdev->eps[ep_index].stream_info); + vdev->eps[ep_index].stream_info = NULL; /* FIXME Unset maxPstreams in endpoint context and * update deq ptr to point to normal string ring. */ @@ -1826,6 +1827,7 @@ int xhci_free_streams(struct usb_hcd *hcd, struct usb_device *udev, for (i = 0; i < num_eps; i++) { ep_index = xhci_get_endpoint_index(&eps[i]->desc); xhci_free_stream_info(xhci, vdev->eps[ep_index].stream_info); + vdev->eps[ep_index].stream_info = NULL; /* FIXME Unset maxPstreams in endpoint context and * update deq ptr to point to normal string ring. */ |