evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

usb: fix cleanup after failure in hub_configure()

Browse source 
If the hub_configure() fails after setting the hdev->maxchild
the hub->ports might be NULL or point to uninitialized kzallocated
memory causing NULL pointer dereference in hub_quiesce() during cleanup.

Now after such error the hdev->maxchild is set to 0 to avoid cleanup
of uninitialized ports.

Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Krzysztof Mazur 2013-08-22 14:49:38 +02:00 • committed by Greg Kroah-Hartman
parent f375fc520d
commit d0308d4b6b
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
drivers/usb/core/hub.c
View file

@ -1573,6 +1573,7 @@ static int hub_configure(struct usb_hub *hub,
return 0; return 0;
fail: fail:
hdev->maxchild = 0;
dev_err (hub_dev, "config failed, %s (err %d)\n", dev_err (hub_dev, "config failed, %s (err %d)\n",
message, ret); message, ret);
/* hub_disconnect() frees urb and descriptor */ /* hub_disconnect() frees urb and descriptor */