diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-03-25 14:14:27 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-04-30 20:25:08 +0400 |
| commit | 714bc5ef3edaec3ca0cf155fe01411760527c52e (patch) | |
| tree | 0983d463571594d1e834fc89cff594d23c45f91c /drivers/usb/musb/musb_host.c | |
| parent | 5e0e61afa5b342c0197fce2d4fd2a2b515e96b31 (diff) | |
| download | linux-714bc5ef3edaec3ca0cf155fe01411760527c52e.tar.xz | |
musb: potential use after free
We assign "urb->hcpriv = qh;" a few lines down. I'm pretty sure we
want it "urb->hcpriv" to be NULL not a freed value.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/musb/musb_host.c')
| -rw-r--r-- | drivers/usb/musb/musb_host.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c index dec896e888db..877d20b1dff9 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -2042,6 +2042,7 @@ static int musb_urb_enqueue( * odd, rare, error prone, but legal. */ kfree(qh); + qh = NULL; ret = 0; } else ret = musb_schedule(musb, qh, |