Revision 4958cf32f66df854b932b601eef2da3f95973339 authored by Alexey Khoroshilov on 10 August 2014, 16:35:11 UTC, committed by Felipe Balbi on 19 August 2014, 14:21:46 UTC
After dbgp_bind()-dbgp_unbind() cycle happens, static variable dbgp contains pointers to already deallocated memory (dbgp.serial and dbgp.req). If the next dbgp_bind() fails, for example in usb_ep_alloc_request(), dbgp_bind() calls dbgp_unbind() on failure path, and dbgp_unbind() frees dbgp.serial that still stores a pointer to already deallocated memory. The patch sets pointers to NULL in dbgp_unbind(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Felipe Balbi <balbi@ti.com>
1 parent 0c58240
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| arch | ||
| block | ||
| crypto | ||
| drivers | ||
| firmware | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .gitignore | -rw-r--r-- | 1.1 KB |
| .mailmap | -rw-r--r-- | 4.7 KB |
| COPYING | -rw-r--r-- | 18.3 KB |
| CREDITS | -rw-r--r-- | 93.8 KB |
| Kbuild | -rw-r--r-- | 2.5 KB |
| Kconfig | -rw-r--r-- | 252 bytes |
| MAINTAINERS | -rw-r--r-- | 277.8 KB |
| Makefile | -rw-r--r-- | 52.8 KB |
| README | -rw-r--r-- | 18.3 KB |
| REPORTING-BUGS | -rw-r--r-- | 7.3 KB |
Computing file changes ...
