lkml.org 
[lkml]   [2020]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 057/191] usb: gadget: fix potential double-free in m66592_probe.
    Date
    From: Qiushi Wu <wu000273@umn.edu>

    [ Upstream commit 44734a594196bf1d474212f38fe3a0d37a73278b ]

    m66592_free_request() is called under label "err_add_udc"
    and "clean_up", and m66592->ep0_req is not set to NULL after
    first free, leading to a double-free. Fix this issue by
    setting m66592->ep0_req to NULL after the first free.

    Fixes: 0f91349b89f3 ("usb: gadget: convert all users to the new udc infrastructure")
    Signed-off-by: Qiushi Wu <wu000273@umn.edu>
    Signed-off-by: Felipe Balbi <balbi@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/usb/gadget/udc/m66592-udc.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/usb/gadget/udc/m66592-udc.c b/drivers/usb/gadget/udc/m66592-udc.c
    index 6e977dc225709..1be409644a483 100644
    --- a/drivers/usb/gadget/udc/m66592-udc.c
    +++ b/drivers/usb/gadget/udc/m66592-udc.c
    @@ -1672,7 +1672,7 @@ static int m66592_probe(struct platform_device *pdev)

    err_add_udc:
    m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req);
    -
    + m66592->ep0_req = NULL;
    clean_up3:
    if (m66592->pdata->on_chip) {
    clk_disable(m66592->clk);
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-29 22:28    [W:2.530 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site