lkml.org 
[lkml]   [2010]   [Jul]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[042/200] USB: ir-usb: fix double free
    2.6.34-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johan Hovold <jhovold@gmail.com>

    commit 2ff78c0c2b67120c8e503268da3f177cae2228a2 upstream.

    If the user specifies a custom bulk buffer size we get a double free at
    port release.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/usb/serial/ir-usb.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/drivers/usb/serial/ir-usb.c
    +++ b/drivers/usb/serial/ir-usb.c
    @@ -312,6 +312,7 @@ static int ir_open(struct tty_struct *tt
    kfree(port->read_urb->transfer_buffer);
    port->read_urb->transfer_buffer = buffer;
    port->read_urb->transfer_buffer_length = buffer_size;
    + port->bulk_in_buffer = buffer;

    buffer = kmalloc(buffer_size, GFP_KERNEL);
    if (!buffer) {
    @@ -321,6 +322,7 @@ static int ir_open(struct tty_struct *tt
    kfree(port->write_urb->transfer_buffer);
    port->write_urb->transfer_buffer = buffer;
    port->write_urb->transfer_buffer_length = buffer_size;
    + port->bulk_out_buffer = buffer;
    port->bulk_out_size = buffer_size;
    }




    \
     
     \ /
      Last update: 2010-07-02 00:01    [W:2.380 / U:16.404 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site