Commit 42d1abb5 authored by Xinming Hu's avatar Xinming Hu Committed by Kalle Valo

mwifiex: usb: kill urb before free its memory

we have observed host system hang when device firmware crash,
stack trace show it was an use-after-free case: previous submitted
urb will be holding in usbcore, and given back to device driver
when device disconnected, while the urb have been freed in usb
device disconnect handler. This patch kill the holding urb before
free its memory.
Signed-off-by: default avatarXinming Hu <huxm@marvell.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent f4c5d599
...@@ -363,6 +363,7 @@ static void mwifiex_usb_free(struct usb_card_rec *card) ...@@ -363,6 +363,7 @@ static void mwifiex_usb_free(struct usb_card_rec *card)
for (i = 0; i < MWIFIEX_TX_DATA_PORT; i++) { for (i = 0; i < MWIFIEX_TX_DATA_PORT; i++) {
port = &card->port[i]; port = &card->port[i];
for (j = 0; j < MWIFIEX_TX_DATA_URB; j++) { for (j = 0; j < MWIFIEX_TX_DATA_URB; j++) {
usb_kill_urb(port->tx_data_list[j].urb);
usb_free_urb(port->tx_data_list[j].urb); usb_free_urb(port->tx_data_list[j].urb);
port->tx_data_list[j].urb = NULL; port->tx_data_list[j].urb = NULL;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment