From: Thomas Pugliese Date: Thu, 26 Sep 2013 19:08:16 +0000 (-0500) Subject: usb: wusbcore: set pointers to NULL after freeing in error cases X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=6741448eb01a1844b78c83fa8faf0c95524fc09b;p=linux.git usb: wusbcore: set pointers to NULL after freeing in error cases This patch fixes two cases where error handling code was freeing memory but not setting the pointer to NULL. This could lead to a double free in the HWA shutdown code. Signed-off-by: Thomas Pugliese Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c index 61b0597c399ba..0b27146b5bc18 100644 --- a/drivers/usb/wusbcore/wa-xfer.c +++ b/drivers/usb/wusbcore/wa-xfer.c @@ -1560,6 +1560,7 @@ error_submit_buf_in: xfer, seg_idx, result); seg->result = result; kfree(wa->buf_in_urb->sg); + wa->buf_in_urb->sg = NULL; error_sg_alloc: __wa_xfer_abort(xfer); error_complete: @@ -1859,6 +1860,7 @@ out: error_dti_urb_submit: usb_put_urb(wa->buf_in_urb); + wa->buf_in_urb = NULL; error_buf_in_urb_alloc: usb_put_urb(wa->dti_urb); wa->dti_urb = NULL;