diff options
| author | Johan Hovold <jhovold@gmail.com> | 2010-05-13 21:02:00 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-07-05 11:15:40 -0700 |
| commit | ca1469edc247d56f9d5282a6ee92e16b224205bc (patch) | |
| tree | 4899b357080e6c2e6b6792e5fe6c62b746c6ceb4 /drivers/usb | |
| parent | 99b8ca62d6e8310bd6d1995d6d66197dc4c6c50c (diff) | |
| download | kernel-crypto-ca1469edc247d56f9d5282a6ee92e16b224205bc.tar.gz kernel-crypto-ca1469edc247d56f9d5282a6ee92e16b224205bc.tar.xz kernel-crypto-ca1469edc247d56f9d5282a6ee92e16b224205bc.zip | |
USB: ir-usb: fix double free
commit 2ff78c0c2b67120c8e503268da3f177cae2228a2 upstream.
If the user specifies a custom bulk buffer size we get a double free at
port release.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/serial/ir-usb.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c index 95d8d26b9a4..2e0497b0226 100644 --- a/drivers/usb/serial/ir-usb.c +++ b/drivers/usb/serial/ir-usb.c @@ -312,6 +312,7 @@ static int ir_open(struct tty_struct *tty, struct usb_serial_port *port) kfree(port->read_urb->transfer_buffer); port->read_urb->transfer_buffer = buffer; port->read_urb->transfer_buffer_length = buffer_size; + port->bulk_in_buffer = buffer; buffer = kmalloc(buffer_size, GFP_KERNEL); if (!buffer) { @@ -321,6 +322,7 @@ static int ir_open(struct tty_struct *tty, struct usb_serial_port *port) kfree(port->write_urb->transfer_buffer); port->write_urb->transfer_buffer = buffer; port->write_urb->transfer_buffer_length = buffer_size; + port->bulk_out_buffer = buffer; port->bulk_out_size = buffer_size; } |