diff options
| author | Johan Hovold <jhovold@gmail.com> | 2010-05-13 21:02:00 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-07-05 11:10:36 -0700 |
| commit | 7c54f6cf0342d52c1b14e06ecbc116419547ef97 (patch) | |
| tree | 564dcb0aae47b44266199ed356d75be2cc27bc9f /drivers | |
| parent | b2fd493630af7d8ce9b313b24dc2516566854c57 (diff) | |
USB: ir-usb: fix double free
commit 2ff78c0c2b67120c8e503268da3f177cae2228a2 upstream.
If the user specifies a custom bulk buffer size we get a double free at
port release.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/serial/ir-usb.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c index 95d8d26b9a44..2e0497b02260 100644 --- a/drivers/usb/serial/ir-usb.c +++ b/drivers/usb/serial/ir-usb.c @@ -312,6 +312,7 @@ static int ir_open(struct tty_struct *tty, struct usb_serial_port *port) kfree(port->read_urb->transfer_buffer); port->read_urb->transfer_buffer = buffer; port->read_urb->transfer_buffer_length = buffer_size; + port->bulk_in_buffer = buffer; buffer = kmalloc(buffer_size, GFP_KERNEL); if (!buffer) { @@ -321,6 +322,7 @@ static int ir_open(struct tty_struct *tty, struct usb_serial_port *port) kfree(port->write_urb->transfer_buffer); port->write_urb->transfer_buffer = buffer; port->write_urb->transfer_buffer_length = buffer_size; + port->bulk_out_buffer = buffer; port->bulk_out_size = buffer_size; } |