Messages in this thread Patch in this message | | | Date | Tue, 10 Jan 2012 13:45:34 -0800 | From | Greg KH <> | Subject | [21/40] drivers/usb/class/cdc-acm.c: clear dangling pointer |
| |
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julia Lawall <julia@diku.dk>
commit e7c8e8605d0bafc705ff27f9da98a1668427cc0f upstream.
On some failures, the country_code field of an acm structure is freed without freeing the acm structure itself. Elsewhere, operations including memcpy and kfree are performed on the country_code field. The patch sets the country_code field to NULL when it is freed, and likewise sets the country_code_size field to 0.
Signed-off-by: Julia Lawall <julia@diku.dk> Acked-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- drivers/usb/class/cdc-acm.c | 4 ++++ 1 file changed, 4 insertions(+)
--- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -1183,6 +1183,8 @@ made_compressed_probe: i = device_create_file(&intf->dev, &dev_attr_wCountryCodes); if (i < 0) { kfree(acm->country_codes); + acm->country_codes = NULL; + acm->country_code_size = 0; goto skip_countries; } @@ -1191,6 +1193,8 @@ made_compressed_probe: if (i < 0) { device_remove_file(&intf->dev, &dev_attr_wCountryCodes); kfree(acm->country_codes); + acm->country_codes = NULL; + acm->country_code_size = 0; goto skip_countries; } }
| |