diff options
| author | Oliver Neukum <oliver@neukum.org> | 2008-06-30 14:33:57 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2008-07-21 15:16:47 -0700 |
| commit | df3e1ab7334279bc744344bcf05272dc8b985d3d (patch) | |
| tree | c76e39449db8e86780442a1ae7f81d969f79c2fe /drivers | |
| parent | 357585892e56f7c7bec4a9c8dfaf90257c8756c6 (diff) | |
| download | op-kernel-dev-df3e1ab7334279bc744344bcf05272dc8b985d3d.zip op-kernel-dev-df3e1ab7334279bc744344bcf05272dc8b985d3d.tar.gz | |
USB: fix double kfree in ipaq in error case
in the error case the ipaq driver leaves a dangling pointer to already
freed memory that will be freed again.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/serial/ipaq.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c index d9fb376..80d9ec5 100644 --- a/drivers/usb/serial/ipaq.c +++ b/drivers/usb/serial/ipaq.c @@ -646,12 +646,13 @@ static int ipaq_open(struct usb_serial_port *port, struct file *filp) */ kfree(port->bulk_in_buffer); - kfree(port->bulk_out_buffer); port->bulk_in_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL); if (port->bulk_in_buffer == NULL) { port->bulk_out_buffer = NULL; /* prevent double free */ goto enomem; } + + kfree(port->bulk_out_buffer); port->bulk_out_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL); if (port->bulk_out_buffer == NULL) { kfree(port->bulk_in_buffer); |
