Commit e3954b4c authored by Michael Grzeschik's avatar Michael Grzeschik Committed by Greg Kroah-Hartman

usb: usbip: set buffer pointers to NULL after free

commit b3b51417 upstream.

The usbip stack dynamically allocates the transfer_buffer and
setup_packet of each urb that got generated by the tcp to usb stub code.
As these pointers are always used only once we will set them to NULL
after use. This is done likewise to the free_urb code in vudc_dev.c.
This patch fixes double kfree situations where the usbip remote side
added the URB_FREE_BUFFER.
Signed-off-by: default avatarMichael Grzeschik <m.grzeschik@pengutronix.de>
Acked-by: default avatarShuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 27279826
...@@ -262,7 +262,11 @@ void stub_device_cleanup_urbs(struct stub_device *sdev) ...@@ -262,7 +262,11 @@ void stub_device_cleanup_urbs(struct stub_device *sdev)
kmem_cache_free(stub_priv_cache, priv); kmem_cache_free(stub_priv_cache, priv);
kfree(urb->transfer_buffer); kfree(urb->transfer_buffer);
urb->transfer_buffer = NULL;
kfree(urb->setup_packet); kfree(urb->setup_packet);
urb->setup_packet = NULL;
usb_free_urb(urb); usb_free_urb(urb);
} }
} }
......
...@@ -28,7 +28,11 @@ static void stub_free_priv_and_urb(struct stub_priv *priv) ...@@ -28,7 +28,11 @@ static void stub_free_priv_and_urb(struct stub_priv *priv)
struct urb *urb = priv->urb; struct urb *urb = priv->urb;
kfree(urb->setup_packet); kfree(urb->setup_packet);
urb->setup_packet = NULL;
kfree(urb->transfer_buffer); kfree(urb->transfer_buffer);
urb->transfer_buffer = NULL;
list_del(&priv->list); list_del(&priv->list);
kmem_cache_free(stub_priv_cache, priv); kmem_cache_free(stub_priv_cache, priv);
usb_free_urb(urb); usb_free_urb(urb);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment