diff options
| author | Luiz Fernando Capitulino <lcapitulino@mandriva.com.br> | 2006-05-11 22:34:17 -0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2006-05-12 11:58:09 -0700 |
| commit | 704936a25bda9bb12e35bb222d5e3f26186dc279 (patch) | |
| tree | 723b247a002e47be72d4ba203277870de0fea220 /drivers/usb/serial/ark3116.c | |
| parent | 16c23f7d88cbcce491f9370b2846fad66e8ef319 (diff) | |
| download | op-kernel-dev-704936a25bda9bb12e35bb222d5e3f26186dc279.zip op-kernel-dev-704936a25bda9bb12e35bb222d5e3f26186dc279.tar.gz | |
[PATCH] usbserial: Fixes use-after-free in serial_open().
If the device is disconnected while serial_open() is executing and
either try_module_get() or the device specific open function fails, the
kref_put() call in the 'bailout_kref_put' label will free the memory
pointed out by 'port'.
The subsequent dereferences in the 'bailout_kref_put' label will be
invalid.
The fix is just to assure kref_put() is called after any 'port' usage.
Signed-off-by: Luiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/serial/ark3116.c')
0 files changed, 0 insertions, 0 deletions
