lkml.org 
[lkml]   [2011]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[60/70] usb: qcserial avoid pointing to freed memory
2.6.38-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Steven Hardy <shardy@redhat.com>

commit 99ab3f9e4eaec35fd2d7159c31b71f17f7e613e3 upstream.

Rework the qcprobe logic such that serial->private is not set when
qcprobe exits with -ENODEV, otherwise serial->private will point to freed
memory on -ENODEV

Signed-off-by: Steven Hardy <shardy@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
drivers/usb/serial/qcserial.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)

--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -111,7 +111,7 @@ static int qcprobe(struct usb_serial *se
ifnum = intf->desc.bInterfaceNumber;
dbg("This Interface = %d", ifnum);

- data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private),
+ data = kzalloc(sizeof(struct usb_wwan_intf_private),
GFP_KERNEL);
if (!data)
return -ENOMEM;
@@ -134,8 +134,10 @@ static int qcprobe(struct usb_serial *se
usb_endpoint_is_bulk_out(&intf->endpoint[1].desc)) {
dbg("QDL port found");

- if (serial->interface->num_altsetting == 1)
- return 0;
+ if (serial->interface->num_altsetting == 1) {
+ retval = 0; /* Success */
+ break;
+ }

retval = usb_set_interface(serial->dev, ifnum, 1);
if (retval < 0) {
@@ -145,7 +147,6 @@ static int qcprobe(struct usb_serial *se
retval = -ENODEV;
kfree(data);
}
- return retval;
}
break;

@@ -177,7 +178,6 @@ static int qcprobe(struct usb_serial *se
retval = -ENODEV;
kfree(data);
}
- return retval;
} else if (ifnum==3) {
/*
* NMEA (serial line 9600 8N1)
@@ -199,9 +199,12 @@ static int qcprobe(struct usb_serial *se
dev_err(&serial->dev->dev,
"unknown number of interfaces: %d\n", nintf);
kfree(data);
- return -ENODEV;
+ retval = -ENODEV;
}

+ /* Set serial->private if not returning -ENODEV */
+ if (retval != -ENODEV)
+ usb_set_serial_data(serial, data);
return retval;
}




\
 
 \ /
  Last update: 2011-04-19 22:23    [W:0.167 / U:9.620 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site