aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJulia Lawall <julia@diku.dk>2011-12-23 14:02:55 +0100
committerGreg Kroah-Hartman <gregkh@suse.de>2012-01-12 11:29:38 -0800
commit30234e2694cbc1d6985cafc87db5cd4848493196 (patch)
treee60a3ba75b84237ccbdbbab7e3222d1aaf1e545a
parent9e9f6a20b59570ca9374b5e79cf1e7df32c67944 (diff)
downloadvexpress-lsk-30234e2694cbc1d6985cafc87db5cd4848493196.tar.gz
drivers/usb/class/cdc-acm.c: clear dangling pointer
commit e7c8e8605d0bafc705ff27f9da98a1668427cc0f upstream. On some failures, the country_code field of an acm structure is freed without freeing the acm structure itself. Elsewhere, operations including memcpy and kfree are performed on the country_code field. The patch sets the country_code field to NULL when it is freed, and likewise sets the country_code_size field to 0. Signed-off-by: Julia Lawall <julia@diku.dk> Acked-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--drivers/usb/class/cdc-acm.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index a8078d0638f..ea5e487448b 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1183,6 +1183,8 @@ made_compressed_probe:
i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
if (i < 0) {
kfree(acm->country_codes);
+ acm->country_codes = NULL;
+ acm->country_code_size = 0;
goto skip_countries;
}
@@ -1191,6 +1193,8 @@ made_compressed_probe:
if (i < 0) {
device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
kfree(acm->country_codes);
+ acm->country_codes = NULL;
+ acm->country_code_size = 0;
goto skip_countries;
}
}