From debda566010d7939560ce078820003ff18fa97da Mon Sep 17 00:00:00 2001 From: Hemant Kumar Date: Fri, 8 Jul 2016 15:34:08 -0700 Subject: usb: gadget: f_gsi: Set speed descriptor pointers to NULL after free After gsi_unbind() if gsi_bind() function frees speed descriptor due to an error leads to double freeing of descriptor. Fix this issue by setting descriptor pointer back to NULL after freeing the descriptor memory. CRs-Fixed: 1038866 Change-Id: Ic5ee71389b6b20c8557e0a75f9bbe5a1749cf655 Signed-off-by: Hemant Kumar --- drivers/usb/gadget/function/f_gsi.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_gsi.c b/drivers/usb/gadget/function/f_gsi.c index d79e85979e40..84fb715075af 100644 --- a/drivers/usb/gadget/function/f_gsi.c +++ b/drivers/usb/gadget/function/f_gsi.c @@ -2574,11 +2574,16 @@ static void gsi_unbind(struct usb_configuration *c, struct usb_function *f) if (gsi->prot_id == IPA_USB_MBIM) mbim_gsi_ext_config_desc.function.subCompatibleID[0] = 0; - if (gadget_is_superspeed(c->cdev->gadget)) + if (gadget_is_superspeed(c->cdev->gadget)) { usb_free_descriptors(f->ss_descriptors); - if (gadget_is_dualspeed(c->cdev->gadget)) + f->ss_descriptors = NULL; + } + if (gadget_is_dualspeed(c->cdev->gadget)) { usb_free_descriptors(f->hs_descriptors); + f->hs_descriptors = NULL; + } usb_free_descriptors(f->fs_descriptors); + f->fs_descriptors = NULL; if (gsi->c_port.notify) { kfree(gsi->c_port.notify_req->buf); -- cgit v1.2.3