diff options
| author | Alan Stern <stern@rowland.harvard.edu> | 2015-01-30 12:58:26 -0500 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2015-03-01 23:34:20 +0100 |
| commit | 5752d1a50c56bda3228272ac3e77f7f97632a4d8 (patch) | |
| tree | 5aea477ed51982eff5cfde01a13096059e7e1ed6 /include | |
| parent | e047f04b6763dd4929a641b663ebc41d548f1027 (diff) | |
| download | lwn-5752d1a50c56bda3228272ac3e77f7f97632a4d8.tar.gz lwn-5752d1a50c56bda3228272ac3e77f7f97632a4d8.zip | |
USB: fix use-after-free bug in usb_hcd_unlink_urb()
commit c99197902da284b4b723451c1471c45b18537cde upstream.
The usb_hcd_unlink_urb() routine in hcd.c contains two possible
use-after-free errors. The dev_dbg() statement at the end of the
routine dereferences urb and urb->dev even though both structures may
have been deallocated.
This patch fixes the problem by storing urb->dev in a local variable
(avoiding the dereference of urb) and moving the dev_dbg() up before
the usb_put_dev() call.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Joe Lawrence <joe.lawrence@stratus.com>
Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions