diff options
| author | Qiushi Wu <wu000273@umn.edu> | 2020-05-22 23:06:25 -0500 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2020-06-29 20:07:53 -0400 |
| commit | 4e26dd5e3f6746efbc681824360e680b02b76174 (patch) | |
| tree | ed97d43f89296c664791effc1b54e3f4c0c7372e | |
| parent | c16f825fb0a34439414aab5b8f4a30b35656300e (diff) | |
usb: gadget: fix potential double-free in m66592_probe.
[ Upstream commit 44734a594196bf1d474212f38fe3a0d37a73278b ]
m66592_free_request() is called under label "err_add_udc"
and "clean_up", and m66592->ep0_req is not set to NULL after
first free, leading to a double-free. Fix this issue by
setting m66592->ep0_req to NULL after the first free.
Fixes: 0f91349b89f3 ("usb: gadget: convert all users to the new udc infrastructure")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/usb/gadget/udc/m66592-udc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/gadget/udc/m66592-udc.c b/drivers/usb/gadget/udc/m66592-udc.c index b1cfa96cc88f..db95eab8b432 100644 --- a/drivers/usb/gadget/udc/m66592-udc.c +++ b/drivers/usb/gadget/udc/m66592-udc.c @@ -1684,7 +1684,7 @@ static int m66592_probe(struct platform_device *pdev) err_add_udc: m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req); - + m66592->ep0_req = NULL; clean_up3: if (m66592->pdata->on_chip) { clk_disable(m66592->clk); |