]> pilppa.com Git - linux-2.6-omap-h63xx.git/commitdiff
USB: fix race leading to use after free in io_edgeport
authorOliver Neukum <oneukum@suse.de>
Wed, 13 Jun 2007 16:50:41 +0000 (18:50 +0200)
committerGreg Kroah-Hartman <gregkh@suse.de>
Tue, 26 Jun 2007 06:38:06 +0000 (23:38 -0700)
usb_unlink_urb() is asynchronous, therefore an URB's buffer may not
be freed without waiting for the completion handler. This patch switches
to usb_kill_urb(), which is synchronous.
Thanks to Alan for making me look at the remaining users of usb_unlink_urb()

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/usb/serial/io_edgeport.c

index 4807f960150bd389c58127323e3b5fc350dac62f..056e1923c4de16134bb15b96c9f23e3c694809f6 100644 (file)
@@ -3046,11 +3046,11 @@ static void edge_shutdown (struct usb_serial *serial)
        }
        /* free up our endpoint stuff */
        if (edge_serial->is_epic) {
-               usb_unlink_urb(edge_serial->interrupt_read_urb);
+               usb_kill_urb(edge_serial->interrupt_read_urb);
                usb_free_urb(edge_serial->interrupt_read_urb);
                kfree(edge_serial->interrupt_in_buffer);
 
-               usb_unlink_urb(edge_serial->read_urb);
+               usb_kill_urb(edge_serial->read_urb);
                usb_free_urb(edge_serial->read_urb);
                kfree(edge_serial->bulk_in_buffer);
        }