Messages in this thread Patch in this message | | | Date | Sat, 20 Mar 2010 15:24:03 +0300 | From | Dan Carpenter <> | Subject | [patch] musb: potential use after free |
| |
We assign "urb->hcpriv = qh;" a few lines down. I'm pretty sure we want it "urb->hcpriv" to be NULL not a freed value.
Signed-off-by: Dan Carpenter <error27@gmail.com> --- Found with a static checker. I don't have the hardware to test this.
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c index dec896e..877d20b 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -2042,6 +2042,7 @@ static int musb_urb_enqueue( * odd, rare, error prone, but legal. */ kfree(qh); + qh = NULL; ret = 0; } else ret = musb_schedule(musb, qh,
| |