aboutsummaryrefslogtreecommitdiff
path: root/drivers/usb/class
diff options
context:
space:
mode:
authorJulia Lawall <julia@diku.dk>2011-12-23 14:02:55 +0100
committerGreg Kroah-Hartman <gregkh@suse.de>2012-01-04 15:52:43 -0800
commite7c8e8605d0bafc705ff27f9da98a1668427cc0f (patch)
tree28611cae53fdf460b502e4113522181e3ce3f4ce /drivers/usb/class
parent5632c827cbd3617613530ba0e99344192d0a31ca (diff)
drivers/usb/class/cdc-acm.c: clear dangling pointer
On some failures, the country_code field of an acm structure is freed without freeing the acm structure itself. Elsewhere, operations including memcpy and kfree are performed on the country_code field. The patch sets the country_code field to NULL when it is freed, and likewise sets the country_code_size field to 0. Signed-off-by: Julia Lawall <julia@diku.dk> Acked-by: Oliver Neukum <oneukum@suse.de> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/class')
-rw-r--r--drivers/usb/class/cdc-acm.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index d9d9340abe6..57f2e103208 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1230,6 +1230,8 @@ made_compressed_probe:
i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
if (i < 0) {
kfree(acm->country_codes);
+ acm->country_codes = NULL;
+ acm->country_code_size = 0;
goto skip_countries;
}
@@ -1238,6 +1240,8 @@ made_compressed_probe:
if (i < 0) {
device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
kfree(acm->country_codes);
+ acm->country_codes = NULL;
+ acm->country_code_size = 0;
goto skip_countries;
}
}