diff options
| author | Johan Hovold <jhovold@gmail.com> | 2010-05-13 23:02:00 +0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-05-21 00:21:45 +0400 |
| commit | 2ff78c0c2b67120c8e503268da3f177cae2228a2 (patch) | |
| tree | 4c57bfee9bf1501b4ace8008f2f8d8212a756a40 /drivers/usb | |
| parent | 16032c4f5b291af541e9114a09ea20ff5a0dc474 (diff) | |
| download | linux-2ff78c0c2b67120c8e503268da3f177cae2228a2.tar.xz | |
USB: ir-usb: fix double free
If the user specifies a custom bulk buffer size we get a double free at
port release.
Cc: stable <stable@kernel.org>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/serial/ir-usb.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c index 4a0f51974232..71bdbe06baff 100644 --- a/drivers/usb/serial/ir-usb.c +++ b/drivers/usb/serial/ir-usb.c @@ -312,6 +312,7 @@ static int ir_open(struct tty_struct *tty, struct usb_serial_port *port) kfree(port->read_urb->transfer_buffer); port->read_urb->transfer_buffer = buffer; port->read_urb->transfer_buffer_length = buffer_size; + port->bulk_in_buffer = buffer; buffer = kmalloc(buffer_size, GFP_KERNEL); if (!buffer) { @@ -321,6 +322,7 @@ static int ir_open(struct tty_struct *tty, struct usb_serial_port *port) kfree(port->write_urb->transfer_buffer); port->write_urb->transfer_buffer = buffer; port->write_urb->transfer_buffer_length = buffer_size; + port->bulk_out_buffer = buffer; port->bulk_out_size = buffer_size; } |