Commit e7c8e860 authored by Julia Lawall's avatar Julia Lawall Committed by Greg Kroah-Hartman

drivers/usb/class/cdc-acm.c: clear dangling pointer

On some failures, the country_code field of an acm structure is freed
without freeing the acm structure itself.  Elsewhere, operations including
memcpy and kfree are performed on the country_code field.  The patch sets
the country_code field to NULL when it is freed, and likewise sets the
country_code_size field to 0.
Signed-off-by: default avatarJulia Lawall <julia@diku.dk>
Acked-by: default avatarOliver Neukum <oneukum@suse.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 5632c827
......@@ -1230,6 +1230,8 @@ static int acm_probe(struct usb_interface *intf,
i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
if (i < 0) {
kfree(acm->country_codes);
acm->country_codes = NULL;
acm->country_code_size = 0;
goto skip_countries;
}
......@@ -1238,6 +1240,8 @@ static int acm_probe(struct usb_interface *intf,
if (i < 0) {
device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
kfree(acm->country_codes);
acm->country_codes = NULL;
acm->country_code_size = 0;
goto skip_countries;
}
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment