* [PATCH v1] usb: usbfs: fix double-free of usb memory upon submiturb error
@ 2019-08-04 23:50 gavinli
2019-08-05 14:09 ` Alan Stern
0 siblings, 1 reply; 2+ messages in thread
From: gavinli @ 2019-08-04 23:50 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-usb, Steinar H . Gunderson, Gavin Li
From: Gavin Li <git@thegavinli.com>
Upon an error within proc_do_submiturb(), dec_usb_memory_use_count()
gets called once by the error handling tail and again by free_async().
Remove the first call.
Signed-off-by: Gavin Li <git@thegavinli.com>
---
drivers/usb/core/devio.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index fa783531ee88..f026a0d54ce5 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1789,8 +1789,6 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
return 0;
error:
- if (as && as->usbm)
- dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count);
kfree(isopkt);
kfree(dr);
if (as)
--
2.22.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v1] usb: usbfs: fix double-free of usb memory upon submiturb error
2019-08-04 23:50 [PATCH v1] usb: usbfs: fix double-free of usb memory upon submiturb error gavinli
@ 2019-08-05 14:09 ` Alan Stern
0 siblings, 0 replies; 2+ messages in thread
From: Alan Stern @ 2019-08-05 14:09 UTC (permalink / raw)
To: gavinli; +Cc: Greg Kroah-Hartman, linux-usb, Steinar H . Gunderson, Gavin Li
On Sun, 4 Aug 2019 gavinli@thegavinli.com wrote:
> From: Gavin Li <git@thegavinli.com>
>
> Upon an error within proc_do_submiturb(), dec_usb_memory_use_count()
> gets called once by the error handling tail and again by free_async().
> Remove the first call.
>
> Signed-off-by: Gavin Li <git@thegavinli.com>
> ---
> drivers/usb/core/devio.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
> index fa783531ee88..f026a0d54ce5 100644
> --- a/drivers/usb/core/devio.c
> +++ b/drivers/usb/core/devio.c
> @@ -1789,8 +1789,6 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
> return 0;
>
> error:
> - if (as && as->usbm)
> - dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count);
> kfree(isopkt);
> kfree(dr);
> if (as)
Acked-by: Alan Stern <stern@rowland.harvard.edu>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-08-05 14:09 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-04 23:50 [PATCH v1] usb: usbfs: fix double-free of usb memory upon submiturb error gavinli
2019-08-05 14:09 ` Alan Stern
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).