summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2010-03-25 13:14:27 +0200
committerGreg Kroah-Hartman <gregkh@suse.de>2010-04-30 09:25:08 -0700
commit714bc5ef3edaec3ca0cf155fe01411760527c52e (patch)
tree0983d463571594d1e834fc89cff594d23c45f91c
parent5e0e61afa5b342c0197fce2d4fd2a2b515e96b31 (diff)
musb: potential use after free
We assign "urb->hcpriv = qh;" a few lines down. I'm pretty sure we want it "urb->hcpriv" to be NULL not a freed value. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--drivers/usb/musb/musb_host.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index dec896e888db..877d20b1dff9 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2042,6 +2042,7 @@ static int musb_urb_enqueue(
* odd, rare, error prone, but legal.
*/
kfree(qh);
+ qh = NULL;
ret = 0;
} else
ret = musb_schedule(musb, qh,