Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit df4989954abc5ae160865bec79b0f099086decce

Authored by Dan Carpenter
Committed by Felipe Balbi
1 parent 1826e9b1bd
Exists in smarc-imx_3.14.28_1.0.0_ga and in 1 other branch imx_3.14.28_1.0.0_ga

usb: gadget: gadgetfs: potential use after free in unbind() 

ffs_data_put() can sometimes free "ffs" so I have moved the call down
a line below the dereference.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Showing 1 changed file with 1 additions and 1 deletions Side-by-side Diff

drivers/usb/gadget/f_fs.c
Diff comments   View file @ df49899
... ... @@ -1417,8 +1417,8 @@
1417 1417 usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
1418 1418 ffs->ep0req = NULL;
1419 1419 ffs->gadget = NULL;
1420   - ffs_data_put(ffs);
1421 1420 clear_bit(FFS_FL_BOUND, &ffs->flags);
  1421 + ffs_data_put(ffs);
1422 1422 }
1423 1423 }
1424 1424