diff options
| author | Johan Hovold <johan@hovoldconsulting.com> | 2015-11-04 18:55:12 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@google.com> | 2015-11-04 20:35:18 -0800 |
| commit | a51e8551e298841f26ccf02193caf2b69da2434c (patch) | |
| tree | 2902f7b48fbb58c78c4dd6604a53ca8e40e7420f /drivers/staging/greybus/es2.c | |
| parent | 357499df455d30290860a23a33b2eb723f9597ac (diff) | |
greybus: es2: fix use-after-free at disconnect
The interface private data is released as part of host-device removal
and must not be accessed afterwards.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Diffstat (limited to 'drivers/staging/greybus/es2.c')
| -rw-r--r-- | drivers/staging/greybus/es2.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/staging/greybus/es2.c b/drivers/staging/greybus/es2.c index 1e786a6ef7d7..ebf41f740ccc 100644 --- a/drivers/staging/greybus/es2.c +++ b/drivers/staging/greybus/es2.c @@ -510,6 +510,7 @@ static void ap_disconnect(struct usb_interface *interface) { struct es2_ap_dev *es2; struct usb_device *udev; + int *cport_to_ep; int bulk_in; int i; @@ -548,9 +549,10 @@ static void ap_disconnect(struct usb_interface *interface) usb_set_intfdata(interface, NULL); udev = es2->usb_dev; + cport_to_ep = es2->cport_to_ep; gb_hd_remove(es2->hd); - kfree(es2->cport_to_ep); + kfree(cport_to_ep); usb_put_dev(udev); } |