Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-01 00:21:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

usb: gadget: gadgetfs: potential use after free in unbind()

Browse Source 
ffs_data_put() can sometimes free "ffs" so I have moved the call down
a line below the dereference.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
This commit is contained in:
Dan Carpenter 2013-08-23 11:16:15 +03:00 committed by Felipe Balbi
parent 1826e9b1bd
commit df4989954a
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/usb/gadget/f_fs.c
View File

@ -1417,8 +1417,8 @@ static void functionfs_unbind(struct ffs_data *ffs)
usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
ffs->ep0req = NULL;
ffs->gadget = NULL;
ffs_data_put(ffs);
clear_bit(FFS_FL_BOUND, &ffs->flags);
ffs_data_put(ffs);
}
}